Attackers Were on Network for 2 Years, News Corp Says

The publisher of the Wall Street Journal, New York Post, and several other publications had last year disclosed a breach it said was the work of a state-backed actor likely working for China.

The state-sponsored attackers behind a breach that News Corp disclosed last year had actually been on its network for nearly two years already by that time, the publishing giant has disclosed.
In a letter to employees last week, News Corp said an investigation of the incident showed the intruder first broke into its network in February 2020, and remained on it until discovered on Jan. 20, 2022. Over that period, the adversary had access to what News Corp described as business documents and emails pertaining to a limited number of employees. Data that the attacker had access to at the time included names, dates of birth, Social Security numbers, drivers license numbers, and health insurance numbers, News Corp said.
Our investigation indicates that this activity does not appear to be focused on exploiting personal information, the letter noted,
according to reports
. We are not aware of reports of identity theft or fraud in connection with this issue.
When News Corp — the publisher of the Wall Street Journal, New York Post, and several other publications — first disclosed the breach last January, the company described it as an intelligence-gathering effort involving a state-sponsored advanced persistent threat (APT). In a Feb. 4, 2022 report the Wall Street Journal identified the actor as likely
working on behalf of the Chinese government
and focused on gathering the emails of targeted journalists and others.
Its unclear why it took News Corp more than a year after initial breach discovery to disclose the scope of the intrusion and the fact that the attackers had been on its network for nearly 24 months. A spokesperson for News Corp did not directly address that point in response to a Dark Reading request for comment. However, he reiterated the companys previous disclosure about the attack being part of an intelligence-collection effort: Also as was said then, and was reported on, the activity was contained, and targeted a limited number of employees.
The length of time the breach at News Corp remained undetected is high even by current standards. The 2022 edition of IBM and the Ponemon Institutes annual cost of a data breach report showed that organizations on
average took 207 days to detect a breach
, and another 70 days to contain it. That was slightly lower than the average 212 days it took in 2021 for an organization to
detect a breach
and the 75 days it took for them to address it.
Two years to detect a breach is way above average, says Julia OToole, CEO of MyCena Security Solutions. Given that attackers had access to the network for such a long time, they most likely got away with a lot more information than was first perceived, OToole says.
While thats bad enough, whats worse is that less than a third of breaches that happen are actually detected at all. That means many more companies could be in the same situation and just dont know it, OToole notes.
One issue is that threat detection tools, and security analysts monitoring those tools, cannot detect threat actors on the network if the adversaries are using compromised login credentials, OToole explains: Despite all the investment in [threat detection] tools, over 82% of breaches still involve compromised employee access credentials.
Erfan Shadabi, cybersecurity expert at Comforte AG, says organizations often miss cyber intrusions because of a lack of visibility over their assets and poor security hygiene. The increasingly advanced tactics that sophisticated threat actors use to evade detection — like hiding their activity in legitimate traffic — can make detection a huge challenge as well, he says.
One measure that organizations can take to bolster their detection and response capabilities is to implement a zero-trust security model. It requires continuous verification of user identity and authorization, as well as ongoing monitoring of user activity to ensure security, Shadabi tells Dark Reading.
Organizations should also be using tools such as intrusion detection systems (IDS) and security information and event management (SIEM) systems to monitor their networks and systems for unusual activity. Strong access control measures including multifactor authentication (MFA), vulnerability management and auditing, incident response planning, third-party risk management, and security awareness training are all other
crucial steps that organizations can take
to reduce attacker dwell times, he says.
Generally speaking, organizations, particularly large ones, have a difficult time detecting attacks because of their vast technology estates, says Javvad Malik, lead awareness advocate at KnowBe4. Many organizations dont even have an up-to-date asset inventory of hardware and software, so monitoring all of them for breaches and attacks is extremely difficult, he says. In many cases, it boils down to complexity of environments.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Attackers Were on Network for 2 Years, News Corp Says