KQED was not one of the many companies or organisations that were affected by WannaCry in May or a second big attack in June — variously known as NotPetya, ExPetr, Nyetya or GoldenEye — that affected mainly Windows systems in Europe.
A report in the San Francisco Chronicle said all its Internet-connected devices, tools and machinery were disconnected in a bid to isolate and contain the ransomware which hit the organisation on 15 June.
And, as of 18 July (19 July AEST), many of these devices were still offline.
|
Immediately after the attack, the station's email server stopped working. All network-connected devices were taken offline and the broadcasts went off the air for more than 12 hours overnight.
Radio journalists lost hours of work and everyone who was using Windows was told not to touch their machines. Wireless Internet did not work for many days and the staff had to manage without email for a fortnight.
The station has managed to continue its broadcasts for the most part, with the television newscast recording segments from UC Hastings for two successive weeks due to problems caused by the ransomware.
While the report did not give any name for the ransomware, it said that the ransom demanded was 1.7 Bitcoin per file, about US$3637 (A$4572 at today's rates). Given the number of files stored on its computers, the total demand would have been more than KQED's annual revenue of US$71.6 million of which US$39.7 million comes from audience contributions, according to KQED's annual financial disclosure.
KQED chief technology officer Dan Mansergh said anti-virus software had been updated on the morning of the attack. Additionally, the station had firewalls that had been updated, email-scanning software and more than one malware detection program running.
He could not give a figure for the cost of the attack as the station is yet to fully recover from the attack.
The ransomware encrypted files on a "small percentage" of the Windows computers but it appeared that many more were in line to be infected and only timely action by KQED's technical staff prevented a bigger infection taking place.
The report said KQED decided not to pay the ransom and reported the attack to the FBI.