Fast Company used to send an obscene Apple News push notification

It’s been a little while since we had a high-profile media feed hijacking, but tonight someone sent an Apple News notification from Fast Company containing a racial slur and invitation for a particular sexual act. They also posted similar content to the outlet’s website, indicating its CMS or an account on it has been compromised, and now the site appears to be offline, showing visitors a 404 error.

Another article posted to Fast Company’s website before it disappeared included a message from “postpixel,” describing at length how they were able to execute the attack and deriding attempts to secure the outlet’s publishing tools. The message posted to Fast Company’s own site claims they got in thanks to a password that was shared across many accounts, including an administrator.

The hackers also pointed to a forum for trading information stolen in security breaches, where they shared the same details, starting with posts made two days ago. The forum post said they’re releasing thousands of employee records, as well as draft posts from the database, but said customer information was stored in a different database that they did not have access to.

Apple and Fast Company haven’t commented on the incident yet, and it’s unclear exactly how many people received the blast, but a look around social media reveals it went out widely. Vox Media staffers who don’t pay for subscriptions to Fast Company say it popped up on their phones as well.