The Guardian has confirmed it was hit by a ransomware attack in December and that the personal data of UK staff members has been accessed in the incident.
The Guardian Media Group’s chief executive, Anna Bateson, and the Guardian’s editor-in-chief, Katharine Viner, confirmed the news in an update emailed to staff on Wednesday afternoon.
They described the incident as a “highly sophisticated cyber-attack involving unauthorised third-party access to parts of our network”, most likely triggered by a “phishing” attempt in which the victim is tricked, often via email, into downloading malware.
The Guardian said it had no reason to believe the personal data of readers and subscribers had been accessed. It is not believed that the personal data of Guardian US and Guardian Australia staff has been accessed either.
The Information Commissioner’s Office, the UK’s data watchdog, has been informed of the attack, as well as the UK police.
However, the message to staff said there had been no evidence of data being exposed online, so the risk of fraud is considered to be low.
The attack was detected on 20 December and affected parts of the company’s technology infrastructure. Staff, most of whom have been working from home since the attack, have been able to maintain production of a daily newspaper, while online publishing has been unaffected.
“We believe this was a criminal ransomware attack, and not the specific targeting of the Guardian as a media organisation,” said Bateson and Viner.