Impresa media group ransomware attack

In the opening hours of 2022, the Lapsus$ extortion group struck Impresa, Portugal's largest media conglomerate and owner of the weekly newspaper Expresso and the SIC family of television channels. By seizing control of Impresa's cloud infrastructure, the attackers silenced two of the country's most influential newsrooms and turned their own platforms into ransom billboards.

What happened

Over the New Year's weekend, Lapsus$ compromised Impresa's Amazon Web Services (AWS) account — the backbone hosting the group's websites and digital publishing systems. With that access, the attackers defaced every Impresa property, replacing the Expresso and SIC homepages with a ransom note announcing that the company's data was in their hands.

The intrusion went beyond defacement. Lapsus$ hijacked Expresso's verified Twitter account, using it to mock the outlet — including a tweet declaring the group "the president of Portugal" — and sent text messages to Expresso subscribers to amplify the breach and pressure the company. Impresa publicly urged its audiences not to open or forward any communications appearing to come from its brands, since the attackers were impersonating them.

Impact

• The websites of Impresa, Expresso and the SIC channels were knocked offline and remained down for days into the new year.
• Expresso lost access to internal data and its digital archives, which held decades of its own journalism as well as content from other titles, severely hampering its ability to publish.
• Live TV broadcasts on SIC were disrupted around the attack, and the newsroom had to improvise publishing through social channels and a temporary site.
• Portuguese authorities characterised the incident as the largest ransomware attack in the country's history.

No ransom payment was reported, and the attack centred on disruption, extortion pressure and reputational humiliation rather than confirmed mass data exfiltration of customer records.

Attribution

Lapsus$ claimed the attack directly through its ransom note and the hijacked accounts. The group — later linked to a cluster of young, English-speaking actors operating largely through social engineering and account takeover — went on to breach major technology firms including Nvidia, Samsung, Microsoft and Okta in early 2022. The Impresa hit was one of its first high-profile operations and established its signature mix of brazen public taunting and cloud-account compromise.

Why it matters

The Impresa breach showed how a single compromised cloud account can take down an entire national media group, and how press freedom becomes collateral when newsrooms are targeted. By weaponising Impresa's own verified social channels, Lapsus$ demonstrated that the reputational and disinformation dimensions of an attack can rival the technical disruption — a warning that media organisations are high-value targets whose trusted platforms can be turned against their audiences.