Bristol Broadcasting Company, Inc.
Bristol Broadcasting Charleston cyber incident
Summary
Bristol Broadcasting’s WQBE, WVSR and WYNL internet streams were unavailable or unreliable on Oct. 7, 2025, during a disruption reportedly beginning Oct. 5. Over-the-air broadcasts continued, while a listener described additional studio and phone limitations. Ransomware, data theft and responsibility remain unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Intermittent service disruption
Services or systems experienced recurring, unstable, or temporary periods of unavailability.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Bristol Broadcasting’s Charleston operation experienced a documented service disruption in October 2025. We observed failed or unreliable internet streams for WQBE, WVSR and WYNL on Oct. 7. That observation establishes an operational effect independently of the explanation for the outage.
A listener described a WVSR announcement around 7 a.m. Eastern that morning using the term “ransomware” while staff were still assessing the cause. The listener said staff placed the onset on Sunday, Oct. 5. The public cyber characterization supports cyber involvement with medium confidence, but the root cause and any underlying intrusion start remain unverified.
Operational significance
Internet listeners lost or had unreliable access to three station streams while over-the-air broadcasting continued. The incident therefore affected a public distribution channel without establishing a complete broadcast outage.
The listener also described remote presenters unable to join live, affected traffic and weather inserts, and office VoIP and small-cell LTE problems. These additional effects are reported limitations rather than independently tested findings. Our calls reached an automated attendant without reaching a live operator; that result alone does not establish a telephone-system outage.
Bristol’s shared Charleston operation included WVTS and WBES as well as the three affected streams. Their individual service effects were not established. There is no documented interruption to emergency alerts or evidence that all company markets were affected.
Confidence and uncertainty
Confidence is high in the contemporaneously observed streaming failures and medium in the broader studio-impact account. Ransomware confidence remains low: the on-air wording is known through a listener, and no corroborated encryption finding, ransom demand or malware identification establishes ransomware.
The streams used AmperWave players. This identifies their delivery platform, not the location of a compromise or responsibility for the failures. No responsible actor or data exposure has been established.
Analytic gaps
The public record does not identify the initial access method, affected hosts, whether transmitter equipment was involved, or whether any information was accessed, copied, encrypted or removed. It also does not establish containment actions, restoration methods or a comprehensive recovery date.
A recording of the advisory, a direct company account or a technical finding would help resolve the reported ransomware wording and the relationship between the studio limitations and streaming failures.
Retrospective note
Oct. 7, 2025, remains the latest documented operational-impact date. The incident is presumed resolved because of the elapsed time. This status does not assign an exact recovery date or confirm that every affected function was restored on a particular day.
Organizations involved
Impacted locations
Bristol, Virginia
Corporate headquarters of the affected broadcaster. Documented service disruption concerned Charleston; an outage at the Virginia headquarters has not been established.
Charleston, West Virginia
Charleston studio and operating location for the affected station group. Three internet streams failed; over-the-air broadcasts continued.
Source
We observed three Charleston station streams failing on Oct. 7, 2025. A listener described a WVSR announcement referring to ransomware and studio limitations after a Sunday onset. Over-the-air broadcasts continued. Our reporting did not establish the root cause, responsible actor or data exposure.
See something that needs correction?
Signed-in members can report an error, update, or missing source.