Ransomware attack targets Ampersand, jointly owned by major US cable operators

Ampersand, a television advertising sales and technology company jointly owned by Comcast Corporation, Charter Communications, and Cox Communications, fell victim to a ransomware attack that temporarily disrupted its operations.

Ampersand, which has been providing viewership data to advertisers for over four decades, confirmed the attack, as cybersecurity researcher Dominic Alvieri reported. However, the company did not disclose the exact date of the breach or whether a ransom would be paid.

"Ampersand recently experienced a ransomware incident that briefly interrupted regular operations. We have restored a majority of normal business operations and are working with third-party advisors and law enforcement to address this issue," a spokesperson for Ampersand stated. The company emphasized its commitment to a comprehensive analysis of the incident and expressed regret for any inconvenience it may have caused.

The ransomware gang responsible for the attack, known as Black Basta, claimed responsibility but did not reveal the extent of data stolen or publish any samples of the information.

Ampersand is a pivotal player in the advertising industry, collecting extensive data on TV viewership across more than 165 networks, allowing companies to tailor advertisements to specific audiences. Founded in 1981, Ampersand initially served as a one-stop shop for advertisers to purchase cable programming in local TV markets. In 1988, it rebranded as National Cable Advertising following its partnership with the three largest cable companies in the United States. It plays a crucial role in the $6 billion local television advertising business today.

Notably, all three companies that jointly own Ampersand have experienced cybersecurity incidents in recent years. In 2021, Cox faced a ransomware attack with Iranian origins, Charter had the personal information of 550,000 customers exposed in a third-party breach, and thousands of Comcast customers reported account hacks in December.