URBAN ONE, INC.
bd_804c9d3232ba23b6 · schema v1 · pii pii-v1
Full breach record for URBAN ONE, INC. →2 incidents on filePress / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
Urban One Hit by Ransomware: Employee Data Leaked - The420.in. Urban One: Urban One, a US-based media conglomerate, suffered a ransomware attack that compromised sensitive personal information of hundreds of individuals. The incident, discovered in March 2025, involved unauthorized access to the company's network, resulting in the exfiltration of employee data. The compromised details include names, Social Security numbers, direct deposit contact information, tax information, and personal addresses. Linked ransomware group: cactus.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Mar 12, 2025
Press report
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitecactusbd_fb3b1b121e13c3d32025-02-25 · +15dVerified by operator
Regulatory filings (3) · sorted by filing gap
- Massachusetts State AGbd_ed11ba9e276f0dbd2025-04-18 · +37dVerified by operator
- Indiana State AGbd_621a407c554a768d2025-12-29 · +292dCandidate
- New Hampshire State AGbd_9579ac0173e2d89c2025-12-30 · +293dVerified
Filing propagation · 3 filings · 3 states
View merged incident ↗Pattern: first filing Apr 18 (MA), last Dec 30 (NH) — a 256-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
cactus
According to ransomware.live, The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure. There is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox. Source: https://github.com/crocodyli/ThreatActors-TTPs