Twitter blames 'social engineering attack' for widespread hacking

Twitter has said the hacking of multiple high-profile accounts on its platform on Wednesday was "a coordinated social engineering attack", according to an update issued on its official channel.

The wave of hacks targeted users like US presidential candidate Joe Biden, billionaire Elon Musk, Amazon founder Jeff Bezos, reality TV star Kim Kardashian, and former US President Barack Obama, among others - using their accounts to solicit digital currency.

Acknowledging the security breach, Twitter first moved to contain the damage by removing the hackers' tweets and limiting functionality - such as users' ability to publish messages or reset their passwords - for a large group of accounts, even those with no evidence of being compromised.

In the latest update, the company said: "We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools. We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf."

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.
- Twitter Support (@TwitterSupport) July 16, 2020

The social media giant said it was looking into "what other malicious activity" hackers may have conducted or information they may have accessed.
The move to limit functionality even for those verified accounts that had not been compromised was "disruptive", it said, but also an important step to reduce risk.
"We have locked accounts that were compromised and will restore access to the original account owner only when we are certain we can do so securely," said the statement. "Internally, we've taken significant steps to limit access to internal systems and tools while our investigation is ongoing."
Publicly available blockchain records show the apparent scammers received more than $100,000 (Dh367,000) worth of cryptocurrency.
The company said more updates would be issued as their investigation progresses.

Karen Ann Monsy

• karen@khaleejtimes.com