Guardian hit by suspected ransomware attack

The Guardian has been hit by a suspected ransomware attack across its offices, prompting the media group to tell staff to work from home this week and avoid accessing shared networks.

Katharine Viner, the Guardian’s editor-in-chief, and chief executive Anna Bateson told staff on Wednesday that they believed the “serious incident” was “a ransomware attack” but that they were also considering other possibilities.

The circumstances suggest the Guardian has come under a type of criminal assault where hackers lock-up a company’s data or computer system and demand payment to release it. Ransom demands can come several days after the initial attack.

The news group was able to continue publishing articles on its website as it has a bespoke editorial system that was largely unaffected by the attack. “Although some of our internal systems are affected, we are confident we will be able to publish in print tomorrow,” Viner and Bateson said.

The suspected attack has debilitated the Guardian’s internal networks, knocking out WiFi access in buildings and access to shared corporate services and financial systems.

The note to staff earlier in the day had asked staff to “please work from home today” in order to “minimise disruption”. “Do not come to our offices to work unless you are specifically asked to do so,” the note said. “Please do not use VPN to log on to any systems.”

The limited number of staff at the Guardian’s London headquarters on Wednesday were forced to work from laptops and use mobile phones to go online.

Ransomware attacks on corporations were increasingly prevalent throughout 2020 and 2021, in part because the move to remote working has left IT systems more vulnerable to hackers.

But the number of attacks has fallen by almost a quarter in the first half of this year, according to US security company SonicWall, partly because more organisations have refused to pay cyber criminals.

Other potential factors include increased law enforcement and the slump in cryptocurrency prices, the preferred form of payment for ransoms.

The Guardian operates one of the world’s most visited English language news websites, hosting around 94mn unique visitors last month, according to Similarweb.