Cyber Incident Victim: Tiertafel Werne
Date:
Feb 2025
Location:
Germany
Summary
The Tiertafel Werne's Facebook page was compromised by hackers who posted fraudulent donation requests and altered the profile image. Unauthorized access persisted for several weeks, prompting the organization to issue public warnings via alternative channels and file a police report. After regaining control, the group temporarily suspended monetary donations to assess potential financial impacts from the fake appeals while directing supporters to contact them directly. The fraudulent posts were removed, and the legitimate profile was restored.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Between late February and March 2025, unidentified hackers compromised the official Facebook profile of Tiertafel Werne, a German animal welfare charity. The attackers altered the account’s profile picture to an image of actor Tom Selleck and published unauthorized posts containing fraudulent donation appeals with embedded links. These fake solicitations appeared alongside the charity’s legitimate content for approximately five weeks, during which three authorized account holders—including second chairperson Jasmin Mühling—were locked out of the profile. The charity discovered the breach when Mühling noticed posts inconsistent with their standard communications, which typically involved fundraising updates and operational announcements. No legitimate financial transactions occurred through the hacked account during this period, as the organization processes donations via bank transfers, PayPal, or in-person contributions at their City Mall donation box.
Tiertafel Werne initiated containment measures on March 23, 2025, by filing a police report with the Unna Police Department and notifying Meta through Facebook Messenger, where a company representative confirmed the unauthorized access. By March 25, the charity regained partial control of the profile, removed all fraudulent posts, and restored their official logo. As a precaution, they suspended all digital donation channels pending verification of potential financial impacts, directing supporters to coordinate contributions directly via phone or email. Mühling issued warnings through her personal Facebook account in the “Weihnachtsengel für 4 Poften” group to mitigate further victimization. The police publicly documented the incident under cybercrime advisories while emphasizing basic password security protocols. Internal damage assessments focused on determining whether any donors responded to the fraudulent links before the account restoration.