The Modern Cyber Risks Lurking In Media Operations

Uploaded on 2025-08-25 in TECHNOLOGY--Resilience, TECHNOLOGY--Developments, FREE TO VIEW

Until recently, the media’s role in the cybersecurity narrative has largely been that of an observer. Journalists report the breaches, cover the fallout, and chase the state-sponsored fingerprints.

But the line between observer and target is beginning to blur. Just recently, the Venice Film Festival confirmed that it had fallen victim to a cyberattack.

A third-party ticketing platform used to manage event access was compromised, exposing personal data of those registered to attend. The real kicker? Many of those affected were members of the press.

Even the red carpet isn’t immune to the threat of cybercriminals. This wasn’t some grand cracking of newsroom servers or the tapping of a journalist’s phone. It was the simple breach of an events logistics system. But the implication is the same: attackers are getting closer to the media core by compromising the operational edges.

It’s subtle, but this is part of a pattern. Cyber gangs are no longer looking solely at newsrooms, databases, or the live broadcast infrastructure itself; they're expanding into the connective elements that support media operations.

From cloud-based production tools and booking systems to comms apps and travel logistics platforms, the media ecosystem – like every other industry in the world – spans dozens of interlinked platforms, many managed by third parties. Each one represents an attack surface with an opportunity to harvest credentials, map relationships, or introduce friction during time-sensitive coverage. While the goal is often disruption, sometimes it’s access, and sometimes its leverage. But it’s always bad news.

Rolling Out The Red Carpet

In the case of the film festival, the average attendee or onlooker has no idea what goes on behind the scenes of a live event. They’re sprawling digital operations. A single festival, broadcast, or live report might involve credentialing platforms, ticketing vendors, remote production teams, freelance crews, satellite feeds, file-sharing tools, mobile comms apps, and multiple layers of cloud infrastructure. While the surface-level experience may feel seamless and deceptively simple, the underlying architecture is anything but.

Each system, service, and integration point introduces potential vulnerabilities, especially when pulled together under tight timelines and shifting personnel.

As we look ahead, the 2026 FIFA World Cup is expected to draw roughly five million fans in-person and around six billion viewers worldwide. But rather than expecting overt cyberattacks, it’s thought that ticketing and betting platforms are going to be a hotbed of cybercriminal activity. Betting odds can be manipulated, money can be stolen through fake transactions, and users can be tricked with sophisticated phishing scams to give up access to their account. All of this is part of the same “event” and the stakes rarely get as high. Employee devices, security cameras, cloud systems, and edge computing, and tangential platforms like betting sites, are all ways for attackers to get in and undermine trust in the event.

What’s changing is how attackers interpret this complexity. Infiltrating the core infrastructure of a broadcaster may still be difficult, but targeting third-party services around the edges is often easier, and just as valuable.

Compromising a vendor that handles journalist credentials, for example, doesn’t just yield names and email addresses. It opens the door to future targeting, impersonation, and credential harvesting. In environments where speed trumps scrutiny and trust is assumed by necessity, attackers don’t need to breach the newsroom to access the people inside it. They only need to find a loose thread and give it a gentle tug.

Why Traditional Security Models Fall Short

Most security frameworks in media organisations were built around the newsroom perimeter. Think firewalled networks, access-controlled CMS platforms, and endpoint protection for editorial staff. A lot of organisations used to think this way too, but the way media is now produced and distributed no longer fits that model. Events, coverage, and commentary are often coordinated across a mesh of freelancers, remote teams, external vendors, and cloud-hosted tools. Access is time-limited, geographically dispersed, and often shared between individuals who may never interact in person. In this environment, perimeter security is basically SINO – Security in Name Only. It doesn’t work.

The challenge here is fluidity. Many platforms used to support media events are temporary by design: spun up quickly for a premiere, a live debate, or a press junket, then decommissioned or handed off without structured offboarding. Credentials are reused, access lists go stale, and security policies struggle to keep pace with production schedules.

This creates gaps not because anyone is negligent, but because the operational model assumes trust where scrutiny is simply unfeasible. And attackers understand this better than anyone. In media, the pressure to deliver content often outweighs the time needed to secure how it gets made.

Moving Toward Resilience

Newsrooms can’t be locked down. That’s not the answer. They need to be able to breathe and move and build complex, often temporary, supply chains to build coverage and follow the story. But that doesn’t mean security should be an afterthought. There are secure foundations that can be built to enable this kind of agility without compromising on security. For instance, implementing zero-trust principles across the broader media ecosystem. Every vendor, freelancer, and third-party platform should be treated as a potential entry point, requiring authentication, restricted access, and continuous validation, even for short-term projects. Shared folders, credential handoffs, and remote production tools should be secured with the same rigour applied to internal systems.

Resilience also depends on preparation. Media organisations should conduct “tabletop” exercises that simulate attacks on media-specific infrastructure: what happens if a live graphics engine goes dark mid-broadcast, or if a credentialing system is hijacked days before a major event?

Building redundancies into live workflows, hardening endpoints for field reporters, and creating joint response plans between editorial, technical, and event teams can mean the difference between a minor disruption and a total blackout.

In fast-moving, high-visibility environments, security needs to be as dynamic as the content itself.

Tim Grieveson is CSO of ThingsRecon

Image: Andrej Lišakov

You Might Also Read:

How CISOs Can Speak The Language Of Risk & Resilience:

If you like this website and use the comprehensive 8,000+ service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.