Urban One

Summary

Urban One disclosed a breach that began with a sophisticated social engineering campaign and led to the theft of employee names, addresses, Social Security numbers and payroll data. The incident affected 355 people in Texas, prompting the company to offer two years of credit monitoring and to contact law enforcement. The Cactus ransomware gang claimed responsibility, and a forensic review confirmed the data theft without disrupting operations. As the largest media outlet serving the African American community, it operates television channels, radio stations and news websites.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 13, 2025, Urban One experienced the start of a cyberattack that was initiated through a sophisticated social engineering campaign. The attackers were able to exfiltrate internal data while the company remained unaware of the intrusion. Urban One discovered the incident on March 15, 2025, after noticing signs of unauthorized activity. A forensic investigation was launched promptly, and by March 30, 2025, investigators confirmed that data had been stolen by the hackers. Throughout the incident, Urban One reported that its business operations were not disrupted.

The compromised information included names, addresses, Social Security numbers, direct deposit details, and W-2 forms of employees. Notification letters filed in Texas and Massachusetts indicated that 355 individuals in Texas were affected by the breach. In response, Urban One offered two years of credit monitoring services to the victims and contacted law enforcement about the attack. The company disclosed that it is the largest media firm targeting the African American community, operating multiple television channels, dozens of radio stations, and numerous news websites. Urban One reported approximately $450 million in revenue for 2024 and had previously informed California regulators of a 2019 data breach that involved the theft of more than 1,000 Social Security numbers. The Cactus ransomware gang claimed responsibility for the attack on March 12, 2025, a group that emerged in 2023 and was noted by Microsoft for using malware distributed via online advertisements to infect victims.

Sources

Sources available to members: 1 source.