Twitter on Wednesday was hit with an “coordinated social engineering attack” that resulted in takeovers of several Twitter accounts including individuals and companies like Barack Obama, Elon Musk and Apple. The attack resulted in the hackers promoting a bitcoin scam on the accounts that were compromised. The Twitter accounts of Bill Gates, Warren Buffet, Jeff Bezos and the US Democratic presidential candidate Joe Biden requested donations in the cryptocurrency. According to the publicly available records, the attackers received over BTC 12.86252562 from 373 transactions which translates roughly to Rs 88,99,721 or US$ 118,434.
Twitter Reveals Employee Tools Contributed to the Attack
Following an initial investigation, Twitter said that the hackers targeted its employees with access to the platform’s internal systems and tools.
“We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools,” Twitter Support said in a tweet.
Crucially, the company said that it is looking into the possibility of other “malicious activity” that may have been conducted during the attack.
“We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it,” Twitter Support said.
However, Twitter has not elaborated on how the attack was carried out or what internal tools were accessed by the hackers.
“Tough day for us at Twitter,” Jack Dorsey, CEO of Twitter, said in a tweet. “We all feel terrible this happened. We’re diagnosing and will share everything we can when we have a more complete understanding of exactly what happened.”
Twitter Limits Functionality of Verified Twitter Accounts
The company initially halted the functionality of verified Twitter accounts following the attack. The verified accounts appear with blue badges are maintained by users in “music, acting, fashion, government, politics, religion, journalism, media, sports, business, and other key interest areas.” The limited functionality included the inability to tweet, reset account password and “some other account functionalities.”
The company said that the limited functionality affected all verified Twitter accounts including those that were compromised and the accounts that remained unaffected. While Twitter has since lifted most restrictions on the verified accounts, the company said that “further actions” may be implemented.
“Internally, we’ve taken significant steps to limit access to internal systems and tools while our investigation is ongoing,” Twitter Support said.
