A Russian hacker secretly took over a computer server at the BBC before Christmas and tried to sell access to it to other hackers, according to reports.
The BBC's security team believes it managed to secure the site on Saturday 28 December. It had been broken into via a server usually used for uploading large files.
Reuters news agency said the hacker, known online as "HASH" or "Rev0lver", offered proof that he had broken in by posting a screenshot of the server and its files on an underground forum where he was trying to sell access on 25 December.
Alex Holden, founder of Hold Security, a cybersecurity company in Milwaukee, said the hacker didn't specify a price for access, but that the value of being able to get into the BBC server wasn't the same as that of hacking credit card details. "I doubt that the BBC stored 40m credit cards, but they have something as valuable," he said.
"Theoretically speaking, a hacker who is able to manipulate or fabricate a news story may crash financial markets, make millions, and cause billions in losses."
When Syrian hackers managed to break into the Associated Press account in April and faked a story about an attack on the White House, the US stock market dropped by 143 points in seconds.
Holden said: "We often see high-profile companies like the BBC getting breached. Larger companies are targeted more because hackers can easily monetise their gains."
It's unclear whether the hacker found any buyers or took any data, but being able to sell such access can be used by hackers as a bargaining chip to get control of other, more important servers.
"We do not comment on security issues," a BBC spokesman told Reuters.
The attack was carried out against ftp.bbc.co.uk, a computer server that manages file uploads and downloads from the BBC. Holden spotted the hacker trying to sell access.
Getting access can be a first step to taking control of a server and using it either to store stolen files and data, or to create a "command centre" for large networks of compromised PCs which in turn are used for spam and phishing attacks around the web.
Justin Clarke, a principal consultant for cybersecurity firm Cylance, told Reuters that while "HASH" was only offering access to an obscure FTP server, some buyers might see it as a stepping stone to more prized assets within the BBC.
"Accessing that server establishes a foothold within the BBC's network which may allow an attacker to pivot and gain further access to internal BBC resources," he said.
Media companies have repeatedly been targeted by the Syrian Electronic Army, which supports the Syrian president, Bashar al-Assad, as well as other hacker activist groups that deface websites and take over Twitter accounts.
Last January the New York Times reported that it had been repeatedly attacked over four months by Chinese hackers who obtained employees' passwords.
The BBC has been the target of a number of attacks. In 2012 it was subjected to a cyber-attack, allegedly from Iran, that knocked out its Persian service.
guardian.co.uk © Guardian News and Media Limited 2010
image: © Marley WH