Attackers took control of high-profile Twitter accounts, including those of Barack Obama, Joe Biden, Elon Musk, and Apple, and used them to promote a bitcoin scam. Twitter said the attackers had targeted its employees with social engineering to reach internal tools.
What happened
- Around 130 accounts were targeted, and tweets were sent from 45 of them promising to double any bitcoin sent to a given address.
- The scam address received more than 400 transfers worth over $100,000.
- Twitter later said a phone spear-phishing attack on a small number of employees had given the attackers access to internal systems.
- US authorities charged three people within weeks, including a Florida teenager who later pleaded guilty and a UK man.
Why it mattered
The incident showed how insider tools and social engineering could compromise an entire platform, and raised concern about the security of accounts used by world leaders. It also prompted Twitter to tighten internal access controls and increase security training for its staff.
Lessons for organisations
Tightly restrict and monitor access to administrative tools, use phishing-resistant multi-factor authentication for staff, and train employees to verify unexpected calls from supposed colleagues.
Source: US Department of Justice
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
