LockBit takes credit for the ransomware attack on Sacramento PBS station

The LockBit ransomware group has claimed the credit for the November ransomware attack on KVIE, a PBS member television station in Sacramento, California.

The high-profile cybercrime gang made the claim on a dark web site where it leaks victims’ data. LockBit demanded ransom, which the station decided not to pay. KVIE president and general manager David Lowe said that LockBit is now threatening to leak the data stolen during the attack.

KVIE announced the attack on November 23, noting that some of its internal systems were affected on October 31. It immediately took systems offline, notified law enforcement, and hired experts to investigate the incident.

Due to the attack, the station’s mission-critical systems were segmented from the business network, and the group lost access to the station’s payroll, membership, or accounting systems. However, its website and broadcast were not affected.

According to David Lowe, the disruption occurred briefly, affecting a recoverable backup where newer files were not saved. Additionally, some of their local production files were involved, and the station continues to work on restoring the related files. No membership or donor information was breached since the organization does not keep credit card numbers on file.

This is the second known ransomware attack on a PBS station after the Royal ransomware group attacked an Iowa affiliate in early November.