Cyber Incident Victim: Tanzania
Date:
Apr 2025
Location:
Tanzania
Summary
Tanzania restricted access to X after a cyberattack compromised the official police account and used it to spread false information about the president's death. The attack prompted NetBlocks to report that X became inaccessible on major internet service providers in the country. The force issued a statement confirming the account was hacked, denouncing the misinformation as unethical, and urging the public to ignore the false posts while promising strict measures against those responsible. The incident occurred amid heightened tensions after the president recently criticized foreign activists and following the deportation of several Kenyan lawyers and activists.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Tuesday, May 20, 2025, the official X (formerly Twitter) account of the Tanzania Police Force suffered a sophisticated cyberattack. The attackers successfully compromised the account and used it to publish a false announcement declaring the death of President Samia Suluhu Hassan. This malicious post immediately caused significant alarm and confusion across the nation. The incident was detected by external monitoring entities, as NetBlocks, a UK-based organization that tracks internet governance and cybersecurity, reported real-time metrics showing that X had become inaccessible on major Tanzanian internet service providers. The providers identified by NetBlocks included Halotel, Airtel, Liquid Telecom, Habari Node, and Vodacom, indicating a widespread disruption. NetBlocks explicitly linked the service outage to the compromised police account publishing the fabricated death claim, noting it had "enraged" national leaders. By the following day, Wednesday, May 21, journalists from EFE confirmed that access to X was possible in Dar es Salaam, the economic capital, though the operational status of the platform in other regions of Tanzania remained unclear.
In direct response to the breach, the Tanzania Police Force issued a formal communication to the public. The statement confirmed that "false, misleading and unethical information" was circulating on the police force's social media networks, specifically the compromised X account. The police emphasized that the information was not truthful and that the police body itself did not create or disseminate such content. They launched an active investigation to identify and arrest the criminals responsible for creating and spreading the false announcement. Concurrently, the government moved to restrict access to the X platform nationwide following the attack. The police urged citizens to ignore the false information and to avoid further sharing it if encountered, warning that "strict measures" would be taken against anyone who continued to disseminate the fabricated content. This incident occurred against a backdrop of heightened political tension, as President Hassan had recently criticized the interference of foreign activists in national affairs, following the detention and deportation of several Kenyan lawyers and activists who had come to observe the trial of opposition leader Tundu Lissu. Human rights groups and the opposition have consistently reported a wave of repression and detentions of dissidents, despite initial reforms by President Hassan aimed at reversing the severe restrictions on free expression implemented by her predecessor, the late John Magufuli.