Cyber Incident Victim: Julie Bishop
Date:
Mar 2014
Location:
Australia
Summary
The verified Twitter account of Australian Foreign Minister Julie Bishop was compromised by an attacker who posted deceptive tweets urging followers to click on embedded links directing them to a fraudulent Twitter login page designed to harvest credentials. The hacker shared multiple messages with phrases like "LOL u got 2 read this" and "lmao you gotta read this," all containing shortened URLs to the phishing site. While most links were disabled shortly after the incident, the breach risked exposing followers' login details through the spoofed page. Bishop publicly confirmed the account hijacking, which exemplified a credential-theft scheme leveraging high-profile social media access to target unsuspecting users.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 16, 2014, the verified Twitter account of Julie Bishop, Australia’s Minister for Foreign Affairs, was compromised by an unauthorized actor. The hijacking occurred during Australian morning hours, with the attacker posting five tweets containing phrases such as “I’m laughing so much right now at this,” “LOL u got 2 read this, its awesome,” and “haha this blog by you is crazy.” Each message included shortened URLs directing followers to a counterfeit Twitter login page designed to harvest credentials through phishing. Bishop confirmed the breach via her compromised account that same day, publicly acknowledging the security incident. The malicious links remained active initially but were largely disabled by March 18, when news outlets reported the incident. While the exact duration of the attacker’s access wasn’t specified, the incident demonstrated the exploitation of a high-profile political account to distribute fraudulent links.
The attacker’s actions focused on leveraging Bishop’s follower base to propagate phishing attempts, with financial gain cited in source material as a likely motive given the profitability of such scams. No data confirms whether users submitted credentials, though the article noted the possibility of compromised accounts due to the links’ initial functionality. The incident highlighted risks associated with verified accounts of public figures, where attackers prioritize visibility over direct system intrusion. No technical details regarding the compromise method or broader system impacts were disclosed. Response actions were limited to account recovery by Bishop and link deactivation, with no reference to platform-level interventions by Twitter or law enforcement involvement. The breach underscored the persistent threat of social media phishing campaigns targeting trusted entities for credential theft.