Caxton and CTP Publishers and Printers listed by the hunters ransomware group

Overview

On 13 April 2024, the Hunters International ransomware group listed Caxton and CTP Publishers and Printers on its leak site. Caxton and CTP is a major South African media and printing group, publishing newspapers, magazines and community titles across the country. The listing confirmed data exfiltration and encryption.

What was published

The Hunters International listing for Caxton and CTP confirmed that data was exfiltrated and systems encrypted, without providing a record count or inventory. The group has released archives for other victims, but no download linked to Caxton was observed during the analysis window.

Risks for affected individuals

Caxton employees and its base of contributors and subscribers could be exposed if personnel records, subscription data or editorial files were stolen. Media industry data can be used for phishing, impersonation and targeted fraud against individuals named in the records.

What remains unknown

The scale of the exfiltration, the records involved, and whether the group published files are not confirmed. Caxton and CTP has not issued a detailed public statement about the incident.

What affected people should do

Employees should change passwords and enable multi-factor authentication on work accounts. Subscribers and contributors should treat unsolicited messages referencing Caxton publications with caution and verify communications through official channels.