The Guardian has confirmed that the cyber incident it experienced in December was a criminal ransomware attack and that the attackers are believed to have accessed staff data.

An email detailing the attack, seen by The Record, explains that the newspaper “detected suspicious activity on our networks on Tuesday 20th December, resulting in our decision to close our offices and announce the disruption the next day.” The Guardian published details about the email soon afterwards.

According to the email, the Guardian says it is “now clear that we experienced a highly sophisticated cyber attack involving unauthorized third-party access to parts of our network, which appears to have been triggered by a phishing attack.”

The investigation was described as “complex and ongoing” and the email confirmed that, while the Guardian could not yet assess the impact of the incident fully, it has established “that some files containing the personal data of UK staff have been accessed as part of the attack.

The email, signed by the newspaper’s editor Katharine Viner and chief executive Anna Bateson, said that the sensitive data accessed related to employment details, including “name, National Insurance number, address, salary, identity documents such as passports.”