The cyberattack which brought down The New York Times website was the result of "spear phishing" by attackers in India, according to Melbourne IT, the Australian web hosting firm whose defences were breached.
Hackers claiming to be from the Syrian Electronic Army targeted the Times on Wednesday morning Australian time, bringing it down for several hours.
They also targeted twimg.com, a domain used by Twitter for image serving.
Using a valid username and password, hackers accessed the account of one of Melbourne IT's US clients, who resell web domains to companies including The New York Times.
Once inside, the hackers altered the domain coding to direct users away from the site.
Theo Hnarakis, Melbourne IT's chief executive, said the attackers got access to its US client's username and password through a "spear phishing" campaign.
Phishing is any attempt to acquire sensitive information via email by masquerading as a trustworthy source.
Spear phishing is when the attempts are directed at specific people or companies - in this case, Melbourne IT's US client, whom Mr Hnarakis would not name.
"The attack has been sent to a variety of staff of our reseller," he told AAP.
"A few of those staff have responded inadvertently."
He said the attack came from an internet service provider based in India.
Melbourne IT's investigation so far pointed to an attack from the Syrian Electronic Army, who support president Bashar al-Assad.
Mr Hnarakis said he was confident the threat had been neutralised and that other web sites served by Melbourne IT were safe.
The company has shut down all email addresses thought to have been breached during the attack.
"All passwords have been changed, the right blocks have been established, so we're fairly confident this won't occur again."
He said all companies were susceptible to phishing attacks.
On its website, Melbourne IT claims it has "a client list of over 500,000 Australian and international businesses".
