News Site And TV Station Owned By Impreza Conglomerate Hit By Ransomware Attack From Lapsus$ Kelompok Group

JAKARTA - The website of one of Portugal's largest newspapers and major broadcasting stations, both owned by the country's largest media conglomerate, Impresa, went out on Monday 3 January. This comes after being hit by a ransomware attack by hackers over the weekend.

The newspaper Expresso and TV station SIC both reported the incident to the criminal investigation police agency PJ and the National Cyber Security Center (CNCS) and will file a complaint over the attack.

The alleged hackers, who call themselves the Lapsus$ Group, published a message on the website saying internal data would be leaked if the media group failed to pay the ransom. The message included the hacker's email and Telegram contact info. But the group did not immediately return a request for comment from Reuters.

Lapsus$, which claims to gain access to an Amazon Web Services Impresa account, also sent phishing emails to Expresso customers and tweets from the newspaper's verified Twitter account.

The same group allegedly hacked the website of Brazil's Ministry of Health last month, and disabled several systems, including one with information on the national immunization program and another used to issue digital vaccination certificates.

The CNCS coordinator, Lino Santos, told the Observador newspaper that this was the first time the group had launched an attack in the country.

Expresso and SIC's own websites have been offline since Sunday, January 2, with a page displaying a message saying they were "temporarily unavailable" after the attack and would return "as soon as possible".

Meanwhile, these two media organizations are forced to only publish news on their social media channels. They described it as "an unprecedented attack on press freedom in the digital age".