Cyber Incident Victim: Houston Texans
Date:
Jan 2020
Location:
United States of America
Summary
The OurMine hacking group briefly compromised social media accounts belonging to multiple NFL teams, including the Houston Texans' Facebook account, alongside other franchises and the league's official profiles. The attackers leveraged unauthorized access to post promotional content during a short-lived takeover, impacting platforms such as Twitter, Instagram, and Facebook. This coordinated campaign aimed to draw attention to perceived security weaknesses in high-profile accounts, culminating in the suspension of OurMine's own Twitter presence following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 22, 2020, the OurMine hacking group resumed high-profile social media account takeovers after a period of reduced public activity since 2017. The group first compromised Eduardo Saverin's Twitter account that day, targeting the Facebook co-founder and angel investor. This marked the beginning of a hacking spree that expanded to multiple entertainment and sports figures over subsequent days. Between January 22-27, OurMine successfully breached Twitter accounts belonging to Will Smith (CEO of FooVR), Bobby Berk (Queer Eye star), Enrique Hernández (LA Dodgers player), Matt Raub (film director), and Dave Moss (YouTube channel), collectively representing over 1.1 million followers. The hackers used these compromised accounts to promote their group and demonstrate security vulnerabilities in high-profile accounts.
The campaign escalated on January 27 when OurMine simultaneously attacked seven NFL-related entities, including the Houston Texans' Facebook account. Alongside the Texans, the Dallas Cowboys, Buffalo Bills, Minnesota Vikings, Kansas City Chiefs, Green Bay Packers, and the official NFL accounts had their Twitter, Facebook, and/or Instagram profiles compromised. Attackers maintained control for approximately two hours across these platforms, during which they posted announcements about the breaches from OurMine's own Twitter account before its suspension. The coordinated NFL attacks affected accounts with tens of millions of combined followers, though all organizations regained control within hours. No specific post content from the Texans' account was detailed, but the incident formed part of a broader pattern where OurMine exploited weak authentication practices to temporarily hijack prominent social media presences for publicity purposes.