Cyber Threat Actor: Lake Oswego School District Twitter Hacker

The threat actor is known onlyby the alias Lake Oswego School District Twitter Hacker. Open‑source reporting links this alias to activity that originated in the United States of America. The alias appeared in connection with a security incident affecting the Lake Oswego School District on July 5, 2018. During that incident the actor obtained unauthorized access to an employee email account belonging to a district spokesperson. No other aliases, affiliations, or geographic details have been disclosed in publicly available sources.

Using the compromised spokesperson email, the actor sent messages that contained phishing links to roughly two hundred students enrolled in the district. The phishing emails were identified by the district’s IT staff as originating from the compromised mailbox. The district promptly issued a warning to students advising them not to click any links in the unsolicited messages and to report suspicious emails to administrators. The warning emphasized that the emails were not sanctioned by the district and were part of a credential‑harvesting attempt. The district also notified affected families and provided guidance on recognizing phishing attempts. Investigators examined the email logs but did not find evidence that the same credentials were used to access the Twitter account at that time.

Separately, the actor leveraged the compromised Twitter credentials to post an unauthorized tweet that announced a change in ownership of the district’s official Twitter account. The unauthorized tweet was noticed by district officials, who quickly regained control of the account and deleted the misleading post. After regaining access, the district published a correction stating that the tweet was false and that the account remained under district control. Public reports noted that the overall scope of any additional systems or data accessed by the actor remained unclear at the time of disclosure. No further campaigns, malware families, tooling, or attribution to a state or criminal group have been publicly linked to this alias. The July 2018 incident remains the sole publicly documented operation associated with the Lake Oswego School District Twitter Hacker.