Garda regain control of official X accounts after crypto hack
Some of the posts appeared targeted at individual users.
An Garda Síochána have confirmed they have regained control of social media accounts after a hack which saw “unauthorised access” to two official profiles on X.
The accounts @GardaInfo and @GardaTraffic were taken over in a breach related to cryptocurrency on Wednesday night and members of the public were warned not to interact with the accounts.
The @GardaTraffic and @GardaInfo accounts on X, formerly Twitter, removed some branding and started publishing scores of posts about a cryptocurrency from Wednesday night.
Some of the posts appeared targeted at individual users but would have been visible to hundreds of thousands of people who had followed the official garda accounts.
A warning has been attached to some posts from one of the profiles due to being linked with another suspended account, which can happen for violations of rules around spam, malicious behaviour and security risks.
On Thursday evening, Gardaí confirmed they had regained control of the accounts but they will remain inactive while the Garda National Cyber Crime Bureau carry out its investigations.
They further said the breach was only on X and that there was “no unauthorised access to any Garda systems and that there is no loss or impact on any Garda controlled data”.
Olga Cronin, head of policy at the the Irish Council of Civil Liberties, said: “Any hack of a State agency or body’s systems or online accounts is extremely worrying for all of us.
“An Garda Síochána is entrusted with extremely sensitive and personal information, and their social media accounts could contain valuable personal information via direct messages for example.
“It’s unclear how these accounts were taken over and the extent of the harm or exposure.”
She added: “But secure collection, storage, use and deletion of data – whether it is gathered through social media, tech like body-worn cameras or people walking into a Garda station to report a crime – are essential to An Garda Síochána’s operation and all of our safety.
“An Garda Síochána and X should explain to the public what has happened as soon as is practicable, in order to address public concern.”
The location on both accounts was changed to Amsterdam, the Netherlands, but the @GardaTraffic account, which has 600,000 followers, continued to claim it was the Garda account for traffic and road safety updates.
The @GardaInfo account, which has almost 300,000 followers and is still linked from the official Garda website, was not available under that username for hours as it has been changed to appear as a support account for a cryptocurrency wallet.
However, old videos and posts made by An Garda Síochána were still visible on the account.
The @GardaInfo account was later moved back under that username and the suspicious posts on both accounts were not readily visible when visiting the profiles around 10am.
The accounts had featured advisories that they should not be used to report crimes.
Cybersecurity expert Brian Honan said the incident was “embarrassing” for An Garda Síochána as the organisation tasked with tackling crime instead fell victim to it.
However, Mr Honan told the Press Association that the “hijacking” of corporate accounts is not unusual as attackers often seek out high-profile accounts with trusted names and a large amount of followers.
Speaking generally about such attacks, he said that bad actors may seek to spread misinformation or disinformation, hold the accounts to ransom, or carry out scams.
Mr Honan, the chief executive of BH Consulting, said hackers can gain access to the accounts through phishing emails or messages to the account manager, infecting devices with “info-stealing” viruses or simply by trying easy-to-guess passwords or ones that have been breached before.
He said the best way to avoid such attacks – which can also affect individuals and businesses – is to use strong, unique passwords and enable multi-factor authentication as “an extra layer of protection”.
Asked about the period of time the attackers were in control of the accounts, Mr Honan said it was possible that they could have accessed and stored information that was shared via direct messages.
He said it was also a risk that they could have used direct messaging in an attempt to contact other accounts in a bid to use social engineering to convince them to reveal security details relating to those profiles.