Cox Communications

Summary

A cyber attack caused an internet outage affecting customers in the Tucson area. The telecommunications provider confirmed the incident was contained, attributing service disruptions to defensive measures taken to halt the attack. No evidence of compromised customer data was found. The company emphasized that their response directly led to the temporary loss of connectivity as they neutralized the threat. Service was restored following mitigation efforts, with no indication of unauthorized access to sensitive information during the event.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A cyber attack targeting Cox Communications caused a significant internet outage affecting customers in the Tucson, Arizona area during the weekend preceding September 27, 2022. The disruption impacted residential and business users reliant on Cox's services for connectivity, though the exact duration and number of affected subscribers were not specified in public statements. Cox identified the outage as originating from malicious cyber activity rather than routine technical failures or maintenance. The company's infrastructure in the region experienced operational interference severe enough to halt normal service delivery. Initial public communications confirmed the attack's role in the outage but did not disclose the attack vector, perpetrator identity, or specific systems targeted.

Cox Communications terminated the cyber attack through active defensive measures, which directly contributed to the service interruption as mitigation efforts temporarily disrupted network operations. The company asserted no evidence indicated unauthorized access to or exfiltration of customer personal information during the incident. Restoration of internet services followed the containment of the attack, with Cox maintaining the outage was an unavoidable consequence of neutralizing the threat. No additional compromises or lingering vulnerabilities were reported post-resolution. The incident highlighted operational impacts from cybersecurity responses, though Cox did not elaborate on whether the attack constituted ransomware, DDoS, or another intrusion type in its public disclosures.

Sources

Sources available to members: 1 source.