Cyber Incident Victim: Manchester, England, United Kingdom
Date:
Apr 2025
Location:
United Kingdom
Summary
A verified X account belonging to a UK government minister was compromised to promote a fraudulent cryptocurrency scheme falsely linked to the House of Commons. The attackers posted deceptive content advertising the "$HCC" coin, leveraging the account's credibility and official imagery before the breach was contained and malicious posts removed. This incident aligns with a broader pattern of high-profile account takeovers targeting influential figures to facilitate "pump and dump" crypto scams, where criminals inflate artificial currency value before cashing out. The specific attack yielded minimal financial gain through limited transactions but highlighted persistent vulnerabilities to phishing and credential theft. Parliament reiterated its commitment to cybersecurity awareness while declining to disclose specific protective measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 15, 2025, UK House of Commons Leader Lucy Powell’s verified X account was compromised by hackers who posted fraudulent cryptocurrency promotions. The attackers published multiple posts advertising "$HCC," a fabricated "House of Commons" digital currency falsely described as a community-driven blockchain initiative. These unauthorized messages included the official House of Commons logo and leveraged Powell’s cabinet position and 70,000 followers to imply legitimacy. The MP’s office confirmed the breach occurred on Tuesday morning and stated they swiftly secured the account and deleted the scam content. This incident mirrored prior attacks on high-profile accounts, including BBC journalist Nick Robinson, whose compromised X account earlier that year promoted a "$Today" cryptocurrency after he fell for a phishing email disguised as an X platform communication.
The attackers employed common credential-compromise tactics such as phishing or exploiting passwords leaked in prior data breaches. According to blockchain analysts at CoinShares, the "$HCC" promotion constituted a "pump and dump" scheme designed to inflate the coin’s value through deceptive endorsements before its creators liquidated their holdings. Only 34 transactions occurred, yielding approximately £225 in profit before the scam was disrupted. Action Fraud reported 35,343 similar social media and email account compromises in 2024, underscoring the prevalence of such attacks. UK Parliament officials reiterated their commitment to cybersecurity awareness for members but declined to disclose specific protective measures. The incident highlighted the operational risks of account takeovers targeting public figures to amplify financial scams.