Cyber Incident Victim: Window to the World Communications
Date:
Dec 2018
Location:
United States of America
Summary
A data breach at Window to the World Communications compromised employee email accounts and personal information over nearly two years, impacting approximately 40 current and former staff members. Unusual activity in an employee email account led to investigations confirming unauthorized access, though no evidence of information misuse was found. The organization retained a data security firm to provide affected individuals with complimentary identity monitoring services for two years.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Window to the World Communications, the parent organization of WTTW-Channel 11 and WFMT 98.7-FM, identified a data breach affecting its internal computer systems, with unauthorized access occurring over a nearly two-year period. Investigations initiated by the company and conducted through a law firm and forensic accounting firm determined the breach spanned from December 2018 to August 2020, compromising email accounts and personal information belonging to approximately 40 current and former employees. The intrusion was detected through unusual activity observed in at least one employee email account, though the exact method of initial access or attacker identity remained unspecified in disclosures. Employees were formally notified of the incident in early December 2018, shortly after its discovery, though the breach continued for an additional 20 months before concluding in August 2020. The compromised data included sensitive employee information, though the organization did not publicly specify the exact types of personal data exfiltrated beyond email communications.
In response to the breach, Window to the World Communications engaged external legal and forensic accounting experts to investigate the scope and origin of the intrusion. The organization publicly confirmed the incident on December 1, 2018, stating there was no evidence at that time suggesting misuse of the compromised information. As a remediation measure, the company contracted a data security firm to provide affected individuals with complimentary identity monitoring services for a duration of two years. No operational disruptions to WTTW or WFMT broadcasting services were reported in connection with the incident. The breach remained confined to employee email accounts and associated personal data, with no indication of broader system compromise or impact on audience-facing operations.