Sociedad Española de Radiodifusión

Cadena SER, also known as Sociedad Española de Radiodifusión, is a radio broadcasting organization headquartered in Spain. The entity provides radio broadcasting services that include news, music, and spoken-word content to audiences across the country. As a radio network, it distributes programming through a series of affiliated stations that relay its signal. The organization’s core activity is the production and transmission of radio content for public consumption. Its headquarters location in Spain places it within the national radio market. The name itself reflects its focus on radiodifusión, indicating a commitment to delivering broadcast media. The organization operates within the Spanish radio broadcasting sector. It also maintains an IT services subsidiary that supports its technical infrastructure. The organization’s role extends to supplying content that informs and entertains listeners nationwide. The organization continues to operate as a radio broadcaster serving listeners across Spain.

In November 2019, Cadena SER experienced a ransomware attack that also affected its IT services subsidiary. The attack led to widespread network shutdowns and caused significant operational disruptions across the organization. Security researchers identified the malicious code as a variant of the BitPaymer ransomware linked to the Dridex threat group. Despite the encryption of systems, the radio network managed to maintain broadcasts from its central facility. To contain the threat, all operating systems were disconnected while efforts were made to restore affected components. The organization worked closely with national cybersecurity authorities to coordinate recovery of local station infrastructure. The incident prompted precautionary disconnections by other entities, including a major airport operator, due to concerns about supply‑chain risk. One of the affected companies described the internal situation as chaotic as technicians struggled to mitigate the impact. The attack highlighted the vulnerability of media organizations to ransomware campaigns that exploit third‑party service providers. Recovery efforts required extensive collaboration between internal IT teams and external security specialists to restore normal operations.