Origin of virus that hobbled newspapers still unclear

LOS ANGELES (AP) – The origin of a suspected computer attack that disrupted the Los Angeles Times and Tribune newspapers remained unclear last Sunday after causing delivery delays and being brought to the attention of federal investigators.

San Diego Union-Tribune Publis-her Jeff Light described the incident as “what now seems to have been a malicious attack on the company by computer hackers” in a message posted to the newspaper’s website. He told readers the disruption had mostly seemed to have been brought under control.

The suspected attack prevented the Chicago Tribune, the Baltimore Sun and other papers from publishing paid death notices and classified ads last Saturday. But Tribune Publishing has said no news websites were affected and no customer information was compromised.

Katie Waldman, a spokeswoman for the Department of Homeland Security, said in an e-mail on Sunday that the agency was “aware of reports of a potential cyber incident” affecting several news outlets. She said the department is “working with our government and industry partners to better understand the situation”. The Los Angeles Times, citing “several individuals with knowledge of the Tribune situation,” reported that the attack appeared to be in the form of “Ryuk” ransomware. Tribune Publishing sold the Los Angeles Times and the San Diego Union-Tribune earlier this year for USD500 million to biotech billionaire Dr Patrick Soon-Shiong, but the companies continue to share software, according to the newspaper.

An advisory by the US Depart-ment of Health and Human Services’ cybersecurity programme earlier this year described “Ryuk” attacks as “highly-targetted, well-resourced and planned”.

A former DHS deputy under secretary for cybersecurity Mark Weatherford, who is now Chief Cbersecurity Strategist at California-based vArmour, said on Sunday that phishing links are the most common way such attacks gain entry.

“It’s fairly non-discriminatory. This could happen to anybody, although it seems to be more of a targetted attack,” Weatherford said. He added, however, that it was too early to draw conclusions.

Tribune Publishing also reported the attack to the FBI last Friday, the Chicago Tribune said. The FBI did not immediately return a message seeking comment on Sunday.

Delivery trucks are parked outside the Los Angeles Times Olympic Facility in Los Angeles. – AP