iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
The source code of the major masthead, The New York Times, has been leaked on 4Chan after the media organisation was breached in January thanks to exposed GitHub credentials.
An anonymous user took to 4chan last week, posting a torrent link to 273 gigabytes archive containing over 5,000 repositories.
“Basically all source code belonging to The New York Times Company, 270GB,” the 4Chan user said.
“There are around 5 thousand repos (out of them less than 30 are additionally encrypted I think), 3.6 million files total, uncompressed tar.”
While the data has not been seen by Cyber Daily, a text file shared by the threat actor seen by BleepingComputer revealed the list of 6,223 folders stolen from the company’s repository, with file names that suggest that data pertaining to infrastructure tools, IT documentation and source code was stolen.
The source code allegedly includes that of the game Wordle, which had a peak of 300,000 players in a single day and 2 million a week in late 2021.
The New York Times told BleepingComputer that the threat actor breached its GitHub repositories in January and that the incident did not affect its own systems or operations.
“The underlying event related to [the 4chan] posting occurred in January 2024 when a credential to a cloud-based third-party code platform was inadvertently made available,” The New York Times said.
“The issue was quickly identified, and we took appropriate measures in response at the time. There is no indication of unauthorised access to Times-owned systems nor impact to our operations related to this event. Our security measures include continuous monitoring for anomalous activity.”
The New York Times has suffered cyber attacks in the past, first being attacked in 2013 by the Syrian Electronic Army, which disrupted its website, as well as that of other media outlets.
In 2016, the publication was attacked again by hackers believed to be Russian, who breached its email accounts and those of other US media organisations.
It is also not the first time a threat actor posted a data leak to 4chan.
On 6 June, a threat actor claimed to have downloaded 2.5 gigabytes of data from Disney’s Confluence servers, intending to collect data from the now bust online game Club Penguin.
However, upon further investigation, it was revealed that the data was much more sensitive and included “Disney’s corporate strategies, advertising plans, Disney+, internal developer tools, business projects, and internal infrastructure”.
Be the first to hear the latest developments in the cyber industry.
