A BBC employee (or insider) was directly approached by a criminal gang via encrypted chat, offering a 15%–25% cut of a ransom payment in exchange for providing access to the corporation’s systems. The hackers planned to exploit the insider’s login credentials to infiltrate the BBC, steal sensitive data, and deploy ransomware to extort a payout estimated in the tens of millions—targeting 1% of the BBC’s total revenue. The attack method mirrored a recent case in Brazil, where an IT worker sold access credentials, leading to a $100M loss for a banking victim. While the BBC has not publicly stated its ransomware payment policy, the National Crime Agency advises against compliance. The proposed attack aimed to cripple operations, exfiltrate critical data, and potentially disrupt services, aligning with high-stakes cyber extortion tactics that threaten organizational survival. The insider’s role was pivotal, highlighting the growing risk of collusion between employees and ransomware groups to maximize financial and operational damage.

The data breach experienced by the payroll company Zellis affected The BBC, Boots, and British Airways. The BBC is collaborating closely with Zellis as they urgently examine the scope of the data breach at their third-party supplier after becoming aware of it. An unauthenticated attacker might take advantage of the SQL injection vulnerability to access the database of MOVEit Transfer without authorization. The cybersecurity problem at Zellis, which included one of their third-party providers called MOVEit, has been reported to British Airways as having affected them.