2022 IBC hacking incident

Page last edited 998 days ago
From Nara Wiki
Jump to navigation Jump to search

On January 2, 2022, a number of websites linked to the Independent Broadcasting Corporation were affected by a widespread security hacking incident from a Telegram ransomware group called Wild Faction. The security breach was widely known as The IBC Hack by netizens. Since that date, IBC has been working with the competent authorities to solve the issue.

Timeline[edit | edit source]

At 05:35 on the morning of January 2, 2022, IBC's website was replaced by a message from Wild Faction. The message was as follows:

YOU SUFFERED A RANSOMWARE

DATA WILL BE LEAKED IF THE NECESSARY AMOUNT WON'T BE PAID. WE HAVE ACCESS TO THE CLOUD PANELS (AWS), AS WELL AS OTHER TYPES OF RESOURCES. THE CONTACT LINKS ARE BELOW.

The contact links mentioned were those of a Wild Faction-led news channel (reporting its acts since December 2021) and had a link to a chat; as well as an e-mail link attributed to CTemplar.

Within minutes, several Twitter profiles started reporting that "Wild Faction is the new president of Flarland", with a link to the Telegram channel.

Wild Faction intruded both IBC's intranet and AWS.

After 08:00, IBC announced that it was going to start an emergency website for its radio network, relying on Freeview streams. Within an hour, IBC managed to restore some of its social media accoutns. At 10:32, The Flarlandian Mail made an announcement on its social media profiles. At 10:40, the IBC News Channel reported about the hackings. Both posts said that proceedings to solve the situation were being made.

The Wild Faction tweet was deleted in the early evening.

IBC made a post on social media accounts at around 17:55. The message said:

"In an unprecedented attack on press freedom in Flarland in the digital age, the websites of The Flarlandian Mail, Pick and IBC, as well as some of their social networks, were, this morning, the target of a security breach.

Journalists from IBC's media continue to report on the most relevant happenings in the country and in the world through the pages that remain active on The Flarlandian Mail (#freedomtoinform) and IBC, on Facebook, Linkedin and Instagram.

The IBC group has been working with the competent authorities, namely the Judiciary Police and the Flarlancian Cybersecurity Center, and will file a criminal complaint."

Despite the deletion of the tweets and the restoring of the access of its social media accounts, on the evening of January 2 and throughout January 3, Wild Faction sent phony e-mails to people who were subscribed to IBC newsletters, including streaming service Pick. The e-mails added additional details to their viral tweet (BREAKING: President escaped and accused of homicide) and Wild Faction was the president of Flarland, as per the now-deleted tweet.

The Flarlandian Mail, in response to the e-mails, said:

"ALERT: Dear reader, Following the security breach where The Flarlandian Mail was targeted, an email was sent with the subject: "BREAKING: President escaped and accused of homicide" which was not posted the authorship of The Flarlandian Mail. We recommend deleting it."

The above message was followed by the same message reported by IBC on its social media accounts.

On January 3, The Flarlandian Mail was finally able to restore its newsletters. IBC recommended continuing using its social media accounts to keep its readers updated. IBC also managed to set up restored websites (see below).

On January 5, the IBC Group issued a public apology with Q&A.

Reactions[edit | edit source]

Most of the reactions came from the corporation itself.

Hours after the hacking, news outlets in Bensonia and Hopeland reported about the hackings.

On January 4, competing newspapers and organizations sent messages standing with IBC on its position for the survival of "fair news".

The NDPC on January 6 reported the following: "At the moment, the NDPC does not have complete knowledge of the scope and consequences of this violation, either because IBC itself is not yet able to provide all the necessary answers, or because of the quantity and complexity of the information to be analyzed by the NDPC". The organization also recommended users of the group's sites to change their passwords in sites where they used the same password.

Hacker Richard Peale said that "only a distorted mind would do a connection between me and the IBC ransomware attacks".

Possible conspiracies against IBC[edit | edit source]

The security breach has led to possible reactions about IBC's current populist policies, favoring "lowbrow entertainment" on all of its platforms

Consequences[edit | edit source]

Internet[edit | edit source]

As of January 5, IBC hasn't restored most of its websites, including streaming service Pick.

Currently the news assets of the group have basic websites made using Wordpress.

Radio[edit | edit source]

On January 3, newscasts on IBC Radio were unable to play audio reports.

Television[edit | edit source]

IBC lost its clock starting January 3. Some program graphics lost their standard typefaces.

Effect on IBC Sports subscriptions[edit | edit source]

Metadata[edit | edit source]

IBC's metadata is handled by third-parties on behalf of Freeview who supply the data to EPGs, newspapers and listing magazines. The division wasn't affected.