Cyber Incident Victim: Johnson Newspaper Corp.
Date:
Apr 2019
Location:
United States of America
Summary
A cyber attack involving Ryuk ransomware initially struck a newspaper publishing group, crippling its data infrastructure and disrupting operations across multiple regional locations. The incident resurged later in the week, prompting staff to adapt by working without hard-wired internet connectivity to maintain newspaper production. The attack impacted systems supporting publications in several cities, though employees successfully mitigated immediate operational disruptions through improvised measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The cyber attack targeting Johnson Newspaper Corp. began on Saturday, April 20, 2019, disrupting operations at the Watertown Daily Times. This initial incident crippled the company's data infrastructure, affecting its ability to publish newspapers across multiple New York locations including Ogdensburg, Massena, Carthage, Malone, Oswego, Hudson, Catskill, and Batavia. The ransomware strain Ryuk was identified as responsible for the attack, though specific intrusion vectors and initial access methods remained unspecified in available reporting. Operations were severely compromised as critical systems became inaccessible, forcing immediate adaptations to maintain newspaper production schedules.
The attack resurged on Thursday, April 25, 2019, creating renewed operational challenges. Staff implemented contingency measures by working without hard-wired internet connections to ensure newspaper distribution continued despite persistent infrastructure limitations. This workaround demonstrated the organization's operational resilience while technical recovery efforts progressed. The repeated disruption raised unresolved questions about whether the April 25 event constituted a separate attack or a continuation of the initial April 20 compromise. No data exfiltration claims or ransom demands were publicly documented in available sources, with impacts primarily confined to infrastructure availability rather than confirmed data breaches. Johnson Newspaper Corp. maintained newspaper publication throughout both disruption periods through staff efforts and procedural adjustments.