Ransomware gang sought BBC reporter’s help in hacking media giant

Actors claiming affiliation with the Medusa ransomware group attempted to recruit BBC journalist Joe Tidy to provide initial access to BBC systems, offering a percentage of any ransom and even placing funds in escrow to entice cooperation. The actors urged execution of a script and used MFA-bombing after Tidy hesitated; the journalist reported the contact to BBC security and was disconnected from internal infrastructure. The report links the incident to Medusa’s broader pattern of double-extortion attacks and use of initial-access brokers, noting CISA attribution of hundreds of attacks, and highlights insider recruitment and MFA fatigue as key adversary tactics.