Washington Post Site Hacked by Syrian Group

Story originally appeared on New York Times.

Visitors to some articles on The Washington Post’s Web site Thursday morning were being redirected to the site of the Syrian Electronic Army, a hacker collective that supports the Syrian president, Bashar al-Assad.

The Post said on Thursday afternoon the episode was over and under control. “We have taken defensive measures and removed the offending module,” Emilio Garcia-Ruiz, The Post’s managing editor, wrote in an editor’s note on the site. “At this time, we believe there are no other issues affecting the Post site.”

The paper reported that the Syrian collective had said in a Twitter post that it had also attacked Time magazine and CNN, suggesting it had tried to carry out a coordinated attack on American news outlets.

Mr. Assad has faced intense media scrutiny for the government’s role in the long, bloody civil war taking place in Syria, but the collective did not make it clear whether it targeted The Post because it was displeased with its coverage. An article in the newspaper indicated that it was mostly foreign coverage affected by the breach.

In the editor’s note, Mr. Garcia-Ruiz said the Syrian Electronic Army had said in a tweet that it gained access to the site by hacking one of its business partners called Outbrain. A third-party content recommendation service, Outbrain works by embedding a widget on Web sites filled with sponsored links. Time and CNN also use the service.

A spokeswoman for Time, Jane Lehman, said the company’s sites were not hacked and the security was not compromised. “The content on some of our sites provided by Outbrain was impacted by the hacking activity at Outbrain,” she said.

CNN also said its sites were not directly penetrated. “The security of a vendor plug-in that appeared on CNNi.com was briefly compromised today,” it said in a statement. “The issue was quickly identified and plug-in disabled.”

According to The Atlantic Wire, which also employs Outbrain, the recommendation service sent a statement to its business partners saying in part: “This morning, the Outbrain service was attacked, and as a result, we have taken the service down temporarily as a precautionary measure.”

Mr. Garcia-Ruiz’s post provided this background on the security breach: “A few days ago, The Syrian Electronic Army, allegedly, subjected Post newsroom employees to a sophisticated phishing attack to gain password information. The attack resulted in one staff writer’s personal Twitter account being used to send out a Syrian Electronic Army message. For 30 minutes this morning, some articles on our Web site were redirected to the Syrian Electronic Army’s site. The Syrian Electronic Army, in a tweet, claimed they gained access to elements of our site by hacking one of our business partners, Outbrain.”

On Wednesday, The New York Times’s site was down for several hours. The Times cited technical problems and said there was no indication the site was hacked.