The New York Times suffered a major data breach! Leaked data includes source code, user info, and potentially internal communications — Learn about the potential consequences and how to protect yourself. This article explores the New York Times hack and its impact.
The New York Times (NYT), a media giant in the United States, has suffered a significant data breach. As per the malware repository platform XV Underground, an anonymous threat actor on 4chan has leaked 270GB of data belonging to the NYT after targeting its GitHub account.
The NYT confirmed in its statement that the leak occurred in January 2024 due to the accidental exposure of a credential for a third-party cloud-based code platform (i.e., GitHub).
Today on 4chan someone leaked the source code (?) to the New York Times. They leaked 270GB of data
— vx-underground (@vxunderground) June 6, 2024
They wrote that the New York Times has 5,000+ source code repositories, with less than 30 being encrypted (?). It is 3,600,000 files in total
Note: We haven't reviewed the data
Reportedly, the leaked data contains around 3,600,000 files, including source code for its website, mobile applications, internal tools, and content management systems. It also contains a database with 1,500 user information from an educational site, the source code of the game Wordle, acquired by the NYT in 2022, and various authentication methods, including URLs, passwords, secret keys, and API tokens. Private user keys have also been found.
The leak also reveals internal communications from Slack channels, potentially exposing sensitive information about the NYT’s operations, editorial processes, and employee discussions.
The threat actor claims that The New York Times has over 5,000 source code repositories, with less than 30 of them encrypted. The leak may reveal information about NYT’s internal IT architecture and software development practices, potentially allowing attackers to exploit the organization’s infrastructure.
The files can be downloaded via torrent link, with a list of 6,200 repositories, and the data is stored in three folders, nytimes, nytm, and TheAthletic. The Athletic folder contains iOS.tar and android.tar files comprising the source code for the Athletics mobile app.
However, the leak involves data from the IT/infrastructure/website organization, not the news organization responsible for reporting and editorial content as these platforms use distinct GitHub instances with stricter access controls.
The NYT has confirmed that there is no evidence of unauthorized access to its internal systems or any impact on operations following the leak. Nevertheless, the incident is concerning as this is the second leak of proprietary information onto 4chan, following a recent incident with Club Penguin files, and many unanswered questions such as the motive behind the attack, the extent of the breach, how the attacker accessed the data, and the full scope of the leak.
The NYT is expected to undergo a thorough security review and implement additional measures to prevent future attacks. It is worth noting that this is not the first time the NYT has suffered a cybersecurity incident. In 2013, Chinese hackers infected the newspaper’s computer system, compromising 53 of its journalists.
In 2018, major US newspapers suffered a malware attack that impacted their printing and delivery processes. Affected newspapers included the Chicago Tribune, the San Diego Union-Tribune, the South Florida Sun-Sentinel, the Capital Gazette in Annapolis, the New York Daily News, the Orlando Sentinel, the Hartford Courant, the Wall Street Journal, and the New York Times.
RELATED TOPICS
- Portion of Twitter’s proprietary source code leaked on GitHub
- Hackers Stole GoDaddy Source Code in a Multi-Year Data Breach
- LastPass Security Breach – Hackers Steal Company’s Source Code
- Russian Midnight Blizzard Hackers Breached Microsoft Source Code
- Samsung confirms data breach as Lapsus$ hackers leak its source code
