LONDON/ISLAMABAD/FRANKFURT (THE THURSDAY TIMES) — The Thursday Times has been targeted in a major cyberattack attributed to Indian hackers, following the discovery of a coordinated intrusion into the publication’s digital infrastructure that had persisted for several weeks.
The attack involved unauthorised access to critical systems, the installation of concealed malicious components and repeated attempts to maintain control over parts of the publication’s online operations.
Despite the seriousness of the breach, The Thursday Times has confirmed that its website and digital operations have returned to normal. It is business as usual for the publication, which continues to deliver news and independent reporting without interruption.
The key points
- A sustained intrusion into The Thursday Times’ digital infrastructure, traced back to September, was found during routine maintenance. The publication attributes it to Indian hackers.
- The intruders installed components disguised as legitimate system utilities and returned repeatedly, with further activity in the early hours of Saturday, October 17.
- The technical evidence behind the attribution is being withheld to protect the publication’s security arrangements.
- The website is operating normally, and the publication says its editorial direction is unchanged.
The incident comes as The Thursday Times continues its extensive coverage of protests across India, where demonstrations over alleged electoral irregularities, restrictions on public assembly and the detention of protest leaders have drawn growing attention.
For a publication whose guiding principle is “We are dangerous to those who trade in lies”, the developments offer a timely reminder of the importance of independent reporting, particularly when the facts are politically inconvenient.
A sustained intrusion uncovered
The security breach was discovered during routine technical maintenance, when unusual activity within the website’s infrastructure prompted a wider examination of its systems.
What initially appeared to be a technical irregularity quickly developed into a serious investigation, uncovering evidence of malicious components deliberately concealed within the publication’s digital environment.
The investigation established that the intrusion had begun weeks earlier, with suspicious activity traced back to September. The attackers had installed unauthorised components, disguised them as legitimate system utilities and made changes intended to preserve their access.
Further examination revealed that the perpetrators had returned to the compromised environment repeatedly, with additional activity identified during the early hours of Saturday, October 17.
The intrusion at a glance
The pattern suggested a sustained operation rather than an isolated attempt to disrupt the website.
Investigators also identified interference with essential operational processes, raising concerns about the attackers’ ability to compromise the reliability and integrity of the publication’s digital infrastructure.
The precise technical findings are being withheld for security reasons.
Indian hackers identified
The Thursday Times has conclusively attributed the cyberattack to Indian hackers following its internal security investigation.
The findings, according to the publication, establish the origin of the malicious activity and demonstrate that the breach involved deliberate, repeated interference with its systems.
The publication has chosen not to disclose the technical evidence underlying its attribution, citing the need to protect its security arrangements.
There has been no public finding establishing involvement by the Indian government or any state institution, and the precise motivation behind the operation has not been disclosed.
Nevertheless, the incident raises serious questions about the vulnerability of independent media organisations to cyberattacks, particularly those reporting on politically sensitive developments beyond their national borders.
The attack also illustrates an increasingly significant threat to digital journalism: intrusions designed not simply to cause visible disruption, but to operate discreetly within a publication’s infrastructure over an extended period.
What the investigation found
- Origin: the cyberattack is attributed to Indian hackers, following The Thursday Times’ internal security investigation.
- Method: deliberate, repeated interference, with concealed components disguised as legitimate system utilities and changes made to preserve access.
- Duration: a sustained operation that began in September, with further activity in the early hours of Saturday, October 17.
- Evidence: the technical findings are being withheld to protect the publication’s security arrangements.
Reporting India’s protests as they unfold
The cyberattack comes amid a period of heightened political tension in India, where protests involving students, youth movements and opposition groups have challenged the handling of electoral processes and the authorities’ response to public demonstrations.
Recent demonstrations in New Delhi and other cities have centred on allegations of irregularities in electoral rolls, demands for accountability from election officials and the detention of protesters. The Indian government and the ruling Bharatiya Janata Party have rejected allegations that electoral revisions were designed to benefit the governing party.
The Thursday Times has been reporting these developments, documenting demonstrations, police interventions, political responses and the voices of those demanding answers.
The detention of protest organisers and student leaders, alongside demonstrations in which participants have called for greater democratic accountability, has placed questions of civil liberties and political dissent at the centre of the unfolding story.
Who is who in the protests
People and groups named in The Thursday Times’ reporting on the protests. They are named for context only: nothing in this article links any of them to the cyberattack.
Founder, Cockroach Janta Party
Abhijeet Dipke
Founded the youth-led CJP in May. He and two colleagues were detained from their flight on landing in Delhi on October 10, and a court released them the next day. He then called a “Lehra Do Tiranga” protest for October 16.
Youth-led satirical movement
Cockroach Janta Party (CJP)
Founded in May by Abhijeet Dipke. Its protests demand the resignation of Chief Election Commissioner Gyanesh Kumar and a halt to the revision of the electoral rolls. The Election Commission denies any wrongdoing.
Prime Minister of India
Narendra Modi
Defended India as the “mother of democracy” as the protests continued. The government and the ruling Bharatiya Janata Party reject the allegation that electoral revisions were designed to benefit the governing party.
President, All India Students’ Association
Neha Bora
Among those held in Delhi on October 10. She says the movement is continuing across the country, from Delhi’s Jantar Mantar to Mumbai’s Shivaji Park.
Student organisation
All India Students’ Association (AISA)
A student group taking part in the protests. Its president, Neha Bora, was among those detained at the Delhi protest on October 10.
Two counts of the people detained in Delhi on Saturday, October 10
The figures differ widely depending on who is counting.
The Thursday Times on India’s protests
- Protests gather pace in India (October 16)
- Thousands detained as India’s “largest democracy” faces criticism (October 15)
- Opposition leaders detained at CJP protest in Delhi (October 10)
For The Thursday Times, covering these events is a matter of public interest, not political convenience.
Journalism must be prepared to scrutinise those in power, examine competing claims and report developments that others may find uncomfortable.
The timing of the cyberattack coincides with this reporting, although the investigation has not publicly established that the publication’s coverage of the protests was the motive behind the intrusion.
Whatever the attackers intended, the incident has not altered the publication’s editorial priorities.
A threat to independent journalism
Cyberattacks against news organisations carry consequences extending beyond technical disruption.
A publication’s digital infrastructure is essential to its ability to gather information, publish reports and communicate with readers. Interference with that infrastructure can undermine the independence and reliability of journalism itself.
The threat is particularly significant for independent media organisations operating across international boundaries, where coverage of contentious political developments can attract scrutiny, hostility and attempts to discredit their work.
Interference with that infrastructure can undermine the independence and reliability of journalism itself.
The Thursday Times regards the incident as a serious attack on its operations. Its implications extend to broader questions about the security of independent journalism in an increasingly contested information environment.
Although the breach has now been addressed and normal services restored, the publication recognises the importance of remaining vigilant against future threats.
The incident has reinforced its commitment to protecting its digital operations and ensuring that editorial decisions remain entirely independent of external pressure.
Fully operational, with no change in editorial direction
The Thursday Times has confirmed that its website is functioning normally and that its publishing operations have resumed their usual course.
The disruption has been resolved, and the publication continues to report on major developments in India, Pakistan and across the world.
There will be no change to its editorial direction, no retreat from politically sensitive reporting and no departure from the principles on which the publication was founded.
The Thursday Times remains committed to journalism that questions official narratives, scrutinises competing accounts and gives attention to stories of public importance, regardless of where they originate or whom they concern.
The ongoing protests in India demonstrate precisely why that commitment matters. In an environment marked by competing political claims, disputed accounts and heightened public tensions, the role of journalism is to establish facts, test assertions and present the evidence to readers.
An attack on a publication’s infrastructure cannot determine what it chooses to investigate or report.
Dangerous to those who trade in lies
For The Thursday Times, the events of recent weeks have reinforced rather than weakened its founding principles.
The publication’s defining words, “We are dangerous to those who trade in lies,” are not merely a slogan. They express its commitment to challenging misinformation, questioning those who exercise power and pursuing stories in the public interest.
As protests continue across India and questions over democratic accountability remain at the forefront of public debate, that commitment is more relevant than ever.
The Thursday Times will continue to report events as they unfold, examine the claims of all sides and maintain its editorial independence without intimidation or interference.
The cyberattack has been addressed. The website is operating normally. The newsroom continues its work.
It is business as usual at The Thursday Times.
We are dangerous to those who trade in lies.
Support our mission: follow our reporting
The Thursday Times exists to be dangerous to those who trade in lies. The simplest way to support that work is to follow our reporting where you already read the news, and to share what you find useful.
Further reading∎
- Digital Safety Kit, Committee to Protect Journalists: a starting point for journalists on hacking, phishing and secure communication.
- Small organisations guide to cyber security, UK National Cyber Security Centre: backups, securing devices and accounts, spotting scams.
- India, World Press Freedom Index 2026, Reporters Without Borders.
- On this site: India protests and more editorials.
