Cyber Incident Victim: Caracol Televisión
Date:
May 2022
Location:
Colombia
Summary
A Colombian television broadcaster experienced a cyberattack targeting its operations, prompting investigations by national law enforcement and judicial authorities. The organization confirmed that attackers failed to compromise its news content or jeopardize informational assets, characterizing the incident as an assault on press freedom. Internal systems disruption occurred, though critical journalistic materials remained secure throughout the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the morning of Sunday, May 22, 2022, Caracol Televisión became the target of a cyberattack that disrupted its operations. Colombian authorities, including the Dijín (Dirección de Investigación Criminal e Interpol) of the National Police and the Fiscalía General de la Nación (Attorney General's Office), initiated a criminal investigation into the incident. The attack occurred without prior public warning, though the exact time of initial compromise and duration of unauthorized access remained unspecified in official communications. Caracol Televisión’s management promptly acknowledged the incident through an official statement, characterizing it as a criminal act while emphasizing operational continuity during their response. Technical teams worked to contain the breach, though no details were disclosed regarding specific compromised systems, data exfiltration attempts, or malware used in the attack.
The broadcaster explicitly stated that cybercriminals failed to access or endanger the informational content of its news programming, confirming the integrity of its journalistic materials remained intact. No evidence suggested on-air disruptions or unauthorized content manipulation during the attack window. Caracol Televisión framed the incident as an assault on press freedom, rejecting the attack in its public pronouncement without attributing blame to specific threat actors or groups. The company did not disclose whether ransomware, data theft, or service disruption constituted the primary objective of the attackers. Investigations by law enforcement agencies continued following the incident, though subsequent findings or attribution details were not included in the immediate public reporting from May 22.