OurMine
Attribution profile
- Type
- Sensationalist
- Location
- Saudi Arabia
- Known incidents
- 52 incidents
- Sources
- 24 sources
- First seen
- 2016-01-23
- Last seen
- 2021-01-31
- Updated
- 2026-10-03 01:54
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
OurMine, also known as OurMine Team or OurMine Security, is a hacker group based in Saudi Arabia that has publicly claimed responsibility for numerous social media account takeovers and website defacements targeting high‑profile individuals, corporations, and sports organizations worldwide. The group describes itself as a white‑hat security outfit that conducts hacks to demonstrate weak security and offers remedial services, stating it has no malicious intent. Their observed targeting focuses on sectors such as technology, media, entertainment, and professional sports, with victims including the Twitter accounts of NFL teams, Facebook, FC Barcelona, the International Olympic Committee, Vevo, and executives like Mark Zuckerberg and Jack Dorsey. Initial access is consistently achieved through credential‑based methods: credential stuffing using leaked passwords, reuse of compromised credentials, and exploitation of third‑party social‑media management platforms (e.g., Khoros, Audiense Connect) to post unauthorized content. In some cases, they have leveraged compromised employee accounts for single‑sign‑on services (e.g., Okta) to exfiltrate internal files, as seen in the Vevo incident. No specific malware families or custom tooling are referenced in the sources; the group relies on stolen credentials and platform‑level access rather than bespoke malware. Attribution to a state sponsor or criminal consortium is not established; the group operates independently and presents itself as a private security collective. Representative campaigns include the January 2020 hijacking of multiple NFL team Twitter, Facebook, and Instagram accounts; the February 2020 compromise of Facebook’s Twitter account via Khoros; and the September 2017 Vevo breach that exposed internal files after compromising an employee Okta account.
Incidents
Attributed incidents are available to members.
52 incidentsSources
Sources available to members: 24 sources.