In this week’s bulletin, Charlie shares 15 methods hackers have used to publicise cyber attacks and put pressure on their victims, highlighting why organisations should plan for how attackers might break the news and why it is better to get ahead of the story themselves.
There have been a number of events this week that all seem to point towards me writing a cyber bulletin. Yesterday, I took part in one of the Databarracks wargames, which was well attended and received the best feedback yet of all the ones we have done. The ASOS hack is still being talked about, and then there are the PHP vulnerabilities, which lots of organisations are scrambling to fix.
The ASOS hack was unusual because, for the first time, I think, hostile actors used ASOS’s app to inform customers about the hack. This got me thinking about the different methods attackers have used to put pressure on organisations to pay.
So, this week’s bulletin is a list of the methods hackers have used to put pressure on their victims to pay. I think the list is useful for organisations to consider how hackers might put pressure on them. It also highlights that the timing of an announcement that an organisation has been attacked may be determined by the attacker.
How, then, do attackers publicise an attack and put pressure on their victims?
| Method | Case study | How the attackers broke or amplified the news |
|---|---|---|
| 1. Send notifications through the victim’s own app | ASOS — October 2026 | Customers received an unauthorised push notification headed “ASOS HACKED”, demanding engagement and linking to Telegram. ASOS subsequently confirmed that stolen employee credentials had enabled access to third-party platforms used for customer communications. |
| 2. Announce the breach on internal messaging systems | Uber — September 2022 | The attacker posted to a company-wide Slack channel announcing the breach. Uber confirmed the attacker also changed settings so that some internal websites displayed an image to employees. |
| 3. Display a message on employees’ computers | Sony Pictures — November 2014 | Employees encountered attacker-generated messages on their computers during the attack. |
| 3. Display a message on employees’ computers | Ireland’s Health Service Executive — May 2021 | On 14 May, staff encountered messages on their computers stating that their files had been encrypted by Conti ransomware. The messages also claimed that data had been stolen and threatened publication unless the organisation responded. |
| 4. Publish stolen material on a public forum | Rockstar Games — September 2022 | A hacker posted early Grand Theft Auto VI footage on GTAForums. The material spread across social media, and Rockstar subsequently confirmed a network intrusion. |
| 5. Name the victim and release data on a criminal leak site | Medibank — November 2022 | Attackers published stolen customer information on the dark web, with further releases over subsequent weeks. |
| 6. Contact customers directly with extortion demands | Vastaamo psychotherapy centre — October 2020 | Following demands against the company, individual patients received emails threatening to publish their confidential information unless they paid. |
| 7. Buy advertising to publicise the attack | Campari — November 2020 | Ragnar Locker used a compromised third party’s Facebook advertising account to run advertisements claiming it had stolen Campari data. The advertisements challenged the company’s public account and imposed a negotiation deadline. |
| 8. Publicise a complaint to a regulator | MeridianLink — November 2023 | ALPHV/BlackCat posted screenshots of a complaint it claimed to have submitted to the US Securities and Exchange Commission about its victim’s failure to disclose the incident. |
| 9. Contact journalists directly and give an interview | Co-op — May 2025 | Attackers identifying themselves as DragonForce contacted the BBC’s Joe Tidy through Telegram. During an extended exchange, they supplied samples of stolen customer and employee information to substantiate their claims. After the BBC approached Co-op for comment, the company acknowledged that data relating to a significant number of members had been accessed. |
| 10. Make the organisation’s printers print ransom notes | Royal Mail — January 2023 | Printers at Royal Mail’s Mallusk distribution centre began printing ransom demands. Photographs subsequently circulated on social media, turning an internal demand into public evidence of the attack. The attack occurred against a background of strained industrial relations and an ongoing dispute over pay and working conditions. A wider lesson is that poor employee relations may increase the risk of staff sharing internal incident information publicly, although no verified evidence shows this motivated the sharing of Royal Mail’s ransom note. |
| 11. Publish a video showing stolen information | Minneapolis Public Schools — March 2023 | Medusa published a 51-minute video on Vimeo showing apparently stolen school records, including student and employee information. Vimeo subsequently removed it. |
| 12. Create a website where people can check their exposed information | An unnamed US hotel — June 2022 | ALPHV/BlackCat created a public website resembling a breach notification service, using a domain similar to the hotel’s. Guests and employees could search information exposed by the attackers. The hotel confirmed a cybersecurity incident to the reporting journalist, who withheld its name to limit further exposure. |
| 13. Advertise stolen data for auction | British Library — November 2023 | Following the October attack, Rhysida advertised the stolen information for auction. The Library’s subsequent incident review confirmed that data was put up for auction and later released on the dark web when no ransom was paid. The proposed sale created another news event and the prospect of an unknown buyer obtaining the information. |
| 14. Contact stakeholders to generate pressure on management | Allen Independent School District, Texas — October 2021 | Attackers emailed parents and employees threatening to publish personal information unless the school district paid. The district disputed whether sensitive information had been stolen. |
| 15. Publish claims that implicate the wrong organisation | South Staffordshire Water / Thames Water — August 2022 | Clop initially named Thames Water as its victim, although documents it published pointed to South Staffordshire. Some reporting repeated the incorrect identification before it was corrected. An organisation could face urgent questions about a supposed breach because attackers have named it incorrectly. |
I think understanding how hackers may attack your organisation or put pressure on it is well worth the effort. It allows you to factor into your planning how they might try to gain extra leverage by breaking the news that a hack has taken place.
To me, this means we should not hold off informing stakeholders that a cyber attack has occurred. The organisation should break the news itself rather than leave it to the hackers, which could make it look as though it is trying to cover up the incident. As we have said many times in this bulletin, it is not the initial event that does the damage; it is the perception of a cover-up that has the greater impact.