• The ransomware spread throughout Johnson Newspaper Corp., infecting servers used for internal sharing of content used to produce newspapers in Watertown, Hudson, and Massena.
• The ransomware attack also impacted the media firm’s emails server and Internet-based phones.

Watertown Daily Times, which was initially targeted with a cyber attack on April 27, 2019, was again targeted with a ransomware infection on May 2, 2019.

The big picture

An employee, who was working to rebuild the systems used for advertising design and news page production, identified a ransomware infection on May 2, 2019. However, it is unclear whether it was a second attack, or if the ransomware went undetected for five days.

The ransomware dropped a calling card on the systems that read “Ryuk: Balance of the Shadow Universe”. This left no doubts about the identity of the ransomware that targeted the newspaper corporation.

The media firm is currently working with cybersecurity experts to determine its root cause and remove the ransomware.

What was the impact?

The ransomware spread throughout Johnson Newspaper Corp., infecting servers used for internal sharing of content used to produce newspapers in Watertown, Hudson, and Massena.

• The ransomware attack also impacted the media firm’s emails server and Internet-based phones.
• However, traditional phones lines and advertising phone systems were working.
• The obtiuaries section could not be published on May 2, 2019, as they could not be entered into the publishing system on the day of infection.

“Some reporters and editors worked from their homes, able to work remotely, and others in the office relied on a host of iPhone and iPad wireless hotspots to work,” Watertown Daily Times reported.