Amaturo Sonoma Media Group recovering from cyberattack

Dead air. It’s a broadcaster’s nightmare. But that fear became a reality last week when a local radio group fell victim to a cyberattack.

Hackers brought down four of the eight local radio stations owned and operated by Amaturo Sonoma Media Group, said Michael O’Shea, president and general manager.

The four impacted stations, KSRO, Froggy 92.9, 97.7 The River, and HOT 101.7, went down June 29 at 3 a.m., he said. The transmitters were functioning, but they were silent, effectively taking the stations not just off the air for what would be approximately six hours, but also creating weeks worth of disruptions and lost revenue.

“The engineering team was able to ascertain it wasn't just a simple fix; it was a cataclysmic occurrence,” O’Shea said. “We elected not to negotiate with these offshore hooligans, so we’re putting our servers back together.”

Amaturo’s four other stations were unaffected because they operate on a separate server.

Those stations are KZST 100.1, The Wolf 102.7, The Bull 99.1 and Oldies 107.9.

Also not impacted by the cyberattack was Jazzy 93.7 KJZY FM.

KJZY has licensed 15% of the sales rights to Amaturo, but the station continues to be owned by Gordon Zlot, president of Redwood Empire Stereocasters.

Amaturo is now one week into what O’Shea said is expected to be a two-week rebuilding process of the four hacked stations. The work is being helped somewhat by an old server that was decommissioned in December — yet still contains the data needed to run.

“Now we're just having to load everything that we've had, from music, new songs, to commercials … that have happened over the last six months,” he said, noting that although the four stations are operating, there remain bouts of silence and awkwardness.

“You may hear commercials promoting Christmas; we apologize for this,” goes one of the recordings O’Shea said he prepared for the affected stations to air.

Speaking of the commercials, not having the current ones yet available has cost the company thousands of dollars, O’Shea said.

“Now, the good news from our standpoint is that as of (July 6), we were able to play the current commercials that should be running,” he said, “because it was costing us probably $10,000 a day in lost revenue.”

As far as how much ransom the hackers asked for, that’s unknown because Amaturo wasn’t going to find out, O’Shea said.

The hackers demanded the company’s financial records, O’Shea said, reading an excerpt from the ransom note: “We will study in-depth your finance, bank and income statements, your savings, investments, and present our reasonable demand to you after we review these.”

Amaturo instead is moving forward with recovering from the cyberattack, something it wasn’t prepared for, O’Shea said.

“This is brutal, but we are slugging through it,” he said.

O’Shea said there has been no evidence that Amaturo was specifically targeted, but media outlets are becoming more susceptible to hackers, according to the California Broadcasters Association.

“We are seeing more and more attempts, partly because stations are moving to more automation in terms of how the music library is stored and the advertising is stored,” said Joe Berry, president and CEO of the California Broadcasters Association. “So there's some vulnerability there.”

Cybercriminals’ goal is to deny broadcasters access to technology, he said, adding the California Broadcasters Association doesn’t advise media stations how to handle ransom demands.

The organization does, however, provide them with information needed to help keep their businesses safe, Berry said.

“We've worked with the (federal) Cybersecurity and Infrastructure Security Agency, as well as our counterparts at the National Association of Broadcasters, to offer resources to stations and reminders when we get word from folks that there are a renewed series of attacks,” he said.

O’Shea said he won’t know the final cost from the IT company that is rebuilding, locking down, and adding layers of security onto both servers until the work is done. Yes, the company is taking no chances, also safeguarding the server that was spared.

Amaturo also lost nine years of emails in the attack, O’Shea said, but there are a couple of silver linings. The company’s primary accounting system and scheduling system for the commercials it airs are stored in the cloud.

“It would be near fatal if we lost that, too. We’d have to pay the (ransom) money, probably,” O’Shea said. “But we were able to salvage that, thankfully.”

Correction: Amaturo Sonoma Media Group owns eight stations, rather than nine. Jazzy 93.7 KJZY FM is owned by Redwood Empire Stereocasters.