The Washington Post

The Washington Post experienced a sophisticated cyberattack targeting the email accounts of journalists covering national security and economic policy, particularly those with expertise in China-related matters. The attackers gained unauthorized access to Microsoft email credentials, potentially exposing sensitive correspondence with government officials, policy experts, and international contacts. The breach was detected during routine security monitoring, and immediate containment protocols were initiated. A forensic investigation is ongoing to determine the full extent of data accessed and the methods used by the attackers. The attack suggests advanced operational planning and detailed reconnaissance of the organization's structure.

Source: https://cybersecuritynews.com/washington-post-journalists-microsoft-accounts-hacked/

TPRM report: https://scoringcyber.rankiteo.com/company/washingtonpost

"id": "was901061625",
"linkid": "washingtonpost",
"type": "Cyber Attack",
"date": "6/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Media',
                        'location': 'Washington, D.C.',
                        'name': 'The Washington Post',
                        'type': 'News Organization'}],
 'attack_vector': 'Compromised Microsoft credentials',
 'data_breach': {'sensitivity_of_data': ['High'],
                 'type_of_data_compromised': ['Email communications']},
 'date_detected': 'Thursday',
 'description': 'The Washington Post is investigating a sophisticated '
                'cyberattack that compromised the email accounts of multiple '
                'journalists, with evidence suggesting the involvement of a '
                'foreign government.',
 'impact': {'data_compromised': ['Email communications',
                                 'Sensitive correspondence'],
            'systems_affected': ['Email accounts']},
 'initial_access_broker': {'entry_point': 'Compromised Microsoft credentials',
                           'high_value_targets': ['Journalists covering '
                                                  'national security and '
                                                  'economic policy']},
 'investigation_status': 'Ongoing',
 'motivation': 'Intelligence gathering on national security and economic '
               'policy issues',
 'response': {'communication_strategy': ['Memorandum to affected staff'],
              'containment_measures': ['Mandatory password reset',
                                       'Organization-wide security measures'],
              'incident_response_plan_activated': 'Yes',
              'third_party_assistance': 'Yes'},
 'threat_actor': ['Foreign Government', 'Potentially China'],
 'title': 'Cyberattack on The Washington Post',
 'type': 'Cyber Espionage'}