Ransomware gang sought BBC reporter’s help in hacking media giant

Threat actors claiming to represent the Medusa ransomware gang tried to recruit a BBC journalist by offering a substantial cut of any ransom, allegedly 15% initially and then a further 10%, for insider access to the BBC’s networks. The journalist, Joe Tidy, was contacted in July over Signal by a cybercriminal named “Syndicate” (“Syn”) who warned that the team could demand a ransom in the tens of millions if infiltration succeeded.

Syn even proposed an escrow of 0.5 BTC, currently a little over $55,000, to secure the deal before any hacking began. Tidy reported that the hackers aimed to use his laptop to breach the broadcaster, with the promise of anonymity and repeated MFA login attempts designed to overwhelm him via MFA bombing.

According to CISA, Medusa is a group that emerged in January 2021 and has since been associated with double-extortion attacks and an extortion portal launched in 2023, while the BBC story notes the threat actor’s attempts to recruit an insider and the potential consequences for the journalist if the scheme had succeeded.