Fast Company Is Back From the Dead After Being Hacked

Bouncing back from a hack doesn’t always happen quickly, even at Fast Company. The business news outlet’s website (and its sister sites Inc.com and Mansueto.com) finally came back online on Wednesday afternoon, according to a blog post. The sites were shut down for eight days after Fast Co.’s content management system (CMS) was targeted in a cyber attack.

“I’d like to thank you for your patience…To be sidelined for more than a week was a difficult experience for our team,” wrote Fast Co. editor-in-chief, Brendan Vaughan, in yesterday’s blog post.

On September 25, a hacker remade the news outlet’s homepage, replacing each headline with an “obscene and racist message that proudly claimed credit for the intrusion,” as Vaughan explained it. Then, two days later, the hacker sent out Apple News alerts twice in quick succession with a very similar message, “N*****S TONGUE MY ANUS. THRAX WAS HERE.” The original homepage defacement displayed the same line preceded by “HACKED BY VINNY TROIA.”

Apple News responded by disabling Fast Co.’s channel, and the news outlet opted to shut down all of its sites.

In an unverified post on a hacker forum, the alleged perpetrator “Thrax” provided a lengthy explanation of how they conducted the breach, according to RestorePrivacy and Bleeping Computer. The post described how Thrax was able to easily bypass Fast Co.’s security protocols including HTTP authentication and a uniformly used default password of “pizza123.” According to the hacker, they were able to collect email addresses, usernames, and IP addresses from multiple employees as well as create their own account in the CMS with new credentials.

Without providing much detail, Fast Co. reported on Wednesday that it had conducted a thorough investigation of the breach, and determined “no customer or advertiser information was disclosing in connection with the CMS attack, and that we have taken steps to safeguard against further attacks.”