Embarcadero Media Group

Summary

Embarcadero Media Group reported that its websites were taken over by individuals claiming to be Anonymous, displaying a Guy Fawkes mask and a message demanding removal of content from The Almanac that was alleged to be harmful. The hack prompted the media group’s IT team to work through the night, led to contact with local police and later FBI involvement, and resulted in a temporary shutdown before the sites were restored. CEO Bill Johnson described the incident as a sophisticated attack intended to cause extensive damage, noting that backups and safeguards limited further harm, while security observers questioned whether the act truly originated from the hacktivist collective.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

At 7:01am former employee posted screenshot to Facebook showing Mountain View Voice website replaced with Guy Fawkes mask image and message demanding removal of content from The Almanac, threatening permanent shutdown, instructing to email Bill Johnson. The message included "We do not forgive, we do not forget, we are legion." Jocelyn Dong, editor of Palo Alto Weekly, confirmed websites were hacked at 10:30pm Thursday. Staff reported little clarity on which Almanac story or photos triggered the attack. The IT department began working all night to investigate while newsroom continued normal operations.

Visitors attempting to access sites saw a warning pop-up claiming computer infection and urging a call to a customer support number, which San Jose Inside’s IT identified as a phishing attempt. The group claimed responsibility as Anonymous, though the motive centered on alleged harmful content in The Almanac. Embarcadero Media contacted Palo Alto Police Department to investigate the intrusion. The attack caused all websites operated by the group—Palo Alto Weekly, Mountain View Voice, Pleasanton Weekly, and The Almanac—to be taken offline.

By Friday evening the websites were restored online. CEO Bill Johnson described the incident as a sophisticated and elaborate attack aimed at inflicting extensive damage, noting that backups, safeguards, and a quick IT response prevented more serious harm. The FBI became involved in the investigation following the restoration. No further details about the specific content prompting the attack were disclosed by staff.

Sources

Sources available to members: 1 source.