Six Rivers Media

Summary

Six Rivers Media experienced a cyberattack disrupting servers and critical systems, including phone services and advertising platforms, which temporarily halted classified ads and legal notice processing. Despite the disruption, print and digital newspaper deliveries continued without delay, as cloud-based infrastructure and external servers protected customer data and maintained operations for most publications. The attack did not involve ransomware demands or data exfiltration, and one externally hosted publication remained unaffected. Full restoration of all systems was anticipated within days, with non-essential secondary programs potentially requiring additional recovery time.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Six Rivers Media, LLC, the largest media company in Northeast Tennessee, experienced a cyber-attack on its systems around 2 a.m. on October 28, 2023. The attack disrupted all internal servers, according to Ron Waite, the group publisher and chief operating officer. Despite the disruption, the company maintained newspaper production, with the Kingsport Times News and Johnson City Press publishing their Monday editions without delay. Customers retained access to print deliveries, online articles, and e-editions of the publications. The attack affected the Times News, Johnson City Press, Erwin Record, and Jonesborough Herald & Tribune, but the Mountain City-based Tomahawk remained operational due to its reliance on an external server. Waite stated the incident was strictly a cyber-attack, dismissing ransomware as a motive since no threat actor made contact or issued demands. The intrusion caused immediate operational challenges, including the failure of phone systems and advertising platforms, which remained nonfunctional for at least one to two days post-incident. This outage prevented the processing of classified advertisements and legal notices across affected outlets.

No data exfiltration occurred during the attack, as all personal customer information resided on external servers unaffected by the breach. The company’s cloud-based infrastructure enabled continuity in core services, including content distribution and printing. Waite projected full restoration of primary systems by Wednesday, November 1, though he anticipated lingering issues in noncritical secondary programs. The incident did not disrupt delivery schedules or compromise subscriber access to digital platforms. Recovery efforts focused on restoring phone communications and advertising capabilities while ensuring no residual vulnerabilities remained in critical operational systems. Six Rivers Media emphasized transparency throughout the response, publicly outlining the scope of disruptions and expected timelines for normalization without disclosing technical remediation steps.

Sources

Sources available to members: 1 source.