Cyber Incident Victim: FC Barcelona
Date:
Aug 2017
Location:
Spain
Summary
FC Barcelona's official social media accounts were compromised by the hacker group OurMine, which posted fraudulent announcements claiming the signing of Paris Saint-Germain player Angel Di Maria. The attackers issued fabricated transfer declarations followed by their signature responsibility claim, urging direct contact. The breach occurred shortly after the club publicly pursued legal action against former player Neymar over contractual disputes. The organization regained control of the platforms and confirmed the unauthorized access, assuring resolution efforts were underway. This incident exploited ongoing high-profile transfer rumors involving Di Maria as a potential replacement target following failed negotiations for another player.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 23, 2017, the hacker group OurMine compromised FC Barcelona's official Twitter and Facebook accounts. The intrusion occurred hours after the club publicly disclosed plans to sue former player Neymar for €8.5 million following his record-breaking €222 million transfer to Paris Saint-Germain (PSG). Attackers exploited this period of heightened media attention to post fabricated transfer news, falsely announcing Barcelona's acquisition of PSG midfielder Ángel Di María – a player genuinely linked to the club after their failed pursuit of Liverpool's Philippe Coutinho. The compromised Twitter account published multiple unauthorized tweets, including "Welcome Angel Di Maria to FC Barcelona! #DiMariaFCB" followed by OurMine's signature claim of responsibility. The hackers directed the club to contact them directly through these posts.
Barcelona regained control of their social media accounts within hours of the breach. The club formally acknowledged the incident through a restored Twitter communication stating: "Our accounts have been hacked tonight. We're working to solve the problem as soon as possible. Thanks for your patience." The attack temporarily disrupted official communications during a sensitive period involving high-profile legal and transfer activities. OurMine's actions generated widespread media coverage by leveraging the club's global fanbase and ongoing transfer speculation, though no operational systems beyond social media accounts were confirmed compromised. The false Di María announcement created brief confusion among supporters before the club reestablished authenticated communications channels.