An investigation by the New York State Department of Financial Services has revealed how the great Twitter hack in July happened. A total of 130 high-profile, celebrity accounts were compromised and many were used to tweet about a bitcoin giveaway scam.
How Twitter Was Hacked
The New York State Department of Financial Services (NYDFS) released its Twitter investigation report last week. It explains how the massive Twitter hack on July 15 happened, resulting in many high-profile accounts being accessed and used to tweet about a bitcoin giveaway scam.
A NYSE-listed technology company with a market cap of $40 billion, Twitter has more than 330 million total monthly active users and over 186 million daily active users, including over 36 million (20%) in the U.S., the NYDFS detailed.
The hack began on July 14 when one or more hackers called several Twitter employees, claiming to be calling from the IT department’s help desk about Twitter’s VPN, which a number of employees reported having problems with. “Employees had frequent problems with the VPN connections to the network,” the report details.
Twitter’s VPN problem ballooned when the company shifted to remote working in March due to the Covid-19 outbreak, which put a strain on the company’s technology infrastructure, resulting in frequent VPN problems. “The hackers took advantage of these issues and pretended to be calling from Twitter’s IT department about a VPN problem,” the NYDFS stated, elaborating:
The hackers’ claims were far more credible – and ultimately successful – because Twitter’s employees were all using VPN connections to work and routinely experiencing VPN problems that required IT’s assistance.
The hackers directed the employees to a phishing website that looked identical to the legitimate Twitter VPN website and was hosted by a similarly named domain.
