Google: 80% of news organisations are targeted by state hackers

More than four-fifths of the world's top media organisations, including the Guardian, have been the target of likely state sponsored hacking attacks, according to research from two Google security engineers.

Presented at the ongoing Black Hat Asia 2014 conference in Singapore, Shane Huntley and Morgan Marquis-Boire's research shows that journalists are "massively over-represented" among the targets of state-sponsored hackers.

While the pair didn't go into detail about their methodology, they confirmed to Reuters that Google "tracks the state actors that attack our users".

Those who the company suspects have been the target of such attacks are notified by a banner across the top of their webmail login, such as this displayed to Guardian staffers since mid-March:

View image in fullscreen

Huntley told Reuters that "if you're a journalist or a journalistic organisation we will see state-sponsored targeting and we see it happening regardless of region, we see it from all over the world both from where the targets are and where the targets are from."

Google's advice to those it suspects of being a state target is simple. "Be careful about where you sign in to Google… Always use up-to-date software and] enable 2-step verification in Gmail," the company says in [the support document linked in the above warning.

It does not, however, share information about what specifically prompted the warning, in order "to help defend the integrity of these systems". Instead, the company explains that "it's likely that you received emails containing malicious attachments, links to malicious software downloads, or links to fake websites that are designed to steal your passwords or other personal information."

In April 2013, the Guardian was the victim of a hacking attack by the Syrian Electronic Army, activists linked to Bashar al-Assad's regime. The Twitter accounts for Guardian Music, Guardian Film and Guardian Books, as well as a number of staffers, were taken over by the group following a "spear phishing" attack: targeted emails designed to trick users into revealing their passwords.