Cyberattack disrupts Inquirer publishing, closes newsroom

The Philadelphia Inquirer’s publishing systems were disrupted by a cyberattack that prevented the newspaper from printing its regular Sunday edition on May 14, 2023, temporarily closed its newsroom and took select computer systems offline.

The Inquirer reported that it was not clear when the systems were first breached but that the attack was detected the morning of May 13, when employees found that the newspaper’s content management system wasn’t working. Inquirer Publisher and CEO Elizabeth H. Hughes said in a statement later that day that the paper had “discovered anomalous activity on select computer systems and immediately took those systems off-line.”

The newspaper said it was able to implement workarounds that day that allowed online publication to continue, albeit sometimes at a slower pace.

The Sunday early edition — which was compiled on May 12 — was successfully printed, but the company was unable to print the regular edition of the newspaper. It instead published solely the online version, and printing resumed during the afternoon of May 14 for the Monday edition.

The Inquirer reported that employees were barred from entering the newspaper’s offices until May 16, as the internet servers had also been disrupted.

In an emailed statement on May 14 to Inquirer journalists reporting on the attack, Hughes said that outside cybersecurity experts had been brought in to help restore systems and that an investigation was ongoing into who was behind the attack and whether any employees or particular systems were targeted.

“We appreciate everyone’s patience and understanding as we work to fully restore systems and complete this investigation as soon as possible,” Hughes said. “We will keep our employees and readers informed as we learn more.”

The Inquirer later reported on May 23 that a ransomware group that calls itself Cuba claimed it was behind the attack and had posted a trove of stolen data and files online. Hughes told the newspaper that the company has not found any evidence that materials were actually taken or shared online.