Cyber Incident Victim: The Chaser
Date:
Sep 2024
Location:
United Kingdom
Summary
A Hong Kong diaspora media outlet in Britain reported receiving Google warnings of high-severity government-backed cyberattacks targeting its email systems, with indicators suggesting attempts to compromise credentials or deploy malicious content. The organization, which recently published investigations into Chinese diplomatic pressure on UK educational materials regarding Taiwan, enhanced its security protocols in response. Analysts contextualized the incident amid increasing harassment against Hong Kong journalists domestically and abroad, interpreting it as part of broader efforts to intimidate critical voices overseas. Chinese authorities denied involvement, dismissing allegations as unfounded accusations while maintaining their opposition to cyberattacks. The incident underscores escalating transnational pressures on exiled media groups and their operational security challenges.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 21, 2024, Hong Kong diaspora media outlet The Chaser, operating from Britain, disclosed that Google had alerted them to "government-backed attacks" targeting their company email system. Google classified the attack severity as high, noting such incidents affect only 0.1% of global users. While Google acknowledged potential false alarms, it confirmed detecting suspicious activities consistent with credential theft attempts, including emails containing malicious attachments, harmful software links, or phishing websites. The Chaser responded by immediately reviewing all online security protocols and implementing necessary protective measures. In a public statement, the outlet condemned the attack as an extension of intimidation tactics against Hong Kong's press, emphasizing their relocation to Britain three years prior to operate freely. They characterized the incident as evidence that "the invisible black hand" of repression now targets diaspora media abroad, pledging to continue their journalism despite threats.
The cyberattack followed The Chaser’s August 2024 investigative report revealing that the Chinese Embassy in Britain pressured publisher Dragons Teaching in 2018 to remove references to Taiwan’s official name, "Republic of China," from secondary school textbooks. The publisher reportedly acquiesced to Beijing’s demands. China’s Embassy in Washington denied involvement in the cyberattack, calling accusations "groundless" and "a complete distortion of facts," while reaffirming China’s opposition to all cyberattacks. Concurrently, the Hong Kong Journalists Association documented unprecedented harassment—including online threats and real-world intimidation against journalists, their families, employers, and landlords—from June to August 2024. Benson Wong, a Hong Kong political scholar in Britain, suggested the timing aligned with China’s National Day observances, interpreting the attack as a signal that critical journalists abroad remain vulnerable to interference. The UK’s National Cyber Security Center did not publicly comment on the incident.