Cyber Incident Victim: Kicker
Date:
Jun 2025
Location:
Germany
Summary
The Instagram account of Kicker was compromised by unknown actors who posted a series of unrelated videos that featured Bitcoin and Elon Musk themes while using thumbnails that suggested explicit sexual content. The misleading posts appeared for roughly fifteen minutes before the account was reclaimed and the offending material removed. As of now, the organization has not issued any public statement regarding the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Friday morning, the official Instagram account of the German sports publication Kicker was compromised by unknown attackers. The hijacked account began displaying content that was unrelated to its usual sports and football coverage. Among the posts were videos that suggested a sex video while actually promoting Bitcoin and referencing Elon Musk. These videos were part of a manipulative scheme designed to lure users into clicking on what appeared to be a cryptocurrency giveaway. The deceptive material remained visible for approximately fifteen minutes before it was removed. During that time, users encountered misleading descriptions accompanying the posts.
After the anomalous activity was detected, the Kicker Instagram account was brought back under the control of its legitimate administrators. All of the unauthorized posts were subsequently deleted from the account's timeline. As of the article's publication, Kicker had not issued any public statement regarding the breach or its aftermath. The incident disrupted the normal flow of sports‑related content that followers expect from the publication. The brief exposure of the misleading videos occurred while the account was under unauthorized control. The account now operates normally, with only the intended sports updates appearing.