Rick and Jill Larson, owners of the studio at the center of the Netflix OITNB leak, reveal what happened when they were targeted by hackers, including extortion
Senior Silicon Valley Correspondent @jank0 … Larson Studios president Rick Larson and his wife and business partner …
Context & Ripple Effects
When stolen Orange Is the New Black season 5 episodes hit the web in April 2017 after Netflix refused a ransom, Netflix's only public framing was that 'a production vendor' had been compromised — the vendor stayed anonymous. This piece puts Rick and Jill Larson of Larson Studios on the record as that vendor, describing the extortion they faced directly.
The interview lands mid-escalation: weeks later, [[a:921218|HBO hackers demanded a multimillion-dollar ransom and dumped emails, scripts, and stars' personal phone numbers]], showing the same playbook widening from one show to an entire network's data.
First-order effects
- Larson Studios loses its anonymity as the compromised link in the OITNB chain, putting a small post-production shop's client relationships and reputation under direct scrutiny while it discloses being extorted.
- Netflix's refusal-to-pay stance is now publicly tied to consequences borne by its supplier, not just by Netflix — the Larsons absorbed the extortion pressure that the leak strategy pushed downstream.
Second-order effects
- Streamers and networks facing the same threat model — HBO within weeks — must decide whether paying ransoms buys silence or funds repeat attacks, with HBO's dump of scripts and personal data showing what non-payment escalation looks like.
- Production vendors become a visible attack surface: Starz's later breach, where it issued erroneous DMCA takedowns against reporters covering a leak, signals that distributors' leak-response machinery itself can misfire and compound the damage.
Third-order effects
- If the pattern holds, content security spending shifts from distributor perimeters to the long tail of production vendors, forcing small studios into enterprise-grade security obligations they are least equipped to carry.
- Extortion against media companies hardens into a recurring business model — steal pre-release content, demand payment, publish on refusal — pushing the industry toward coordinated response norms rather than case-by-case ransom decisions.
The trend: Entertainment cyberattacks are migrating from distributors to the production-vendor layer, where extortionists exploit the gap between streamers' no-ransom policies and suppliers' exposure.