Cyber Incident Victim: Department for Digital, Culture, Media and Sport
Date:
Apr 2014
Location:
United Kingdom
Summary
The UK Department of Culture, Media and Sport's verified Twitter account was compromised, leading to unauthorized posts referencing a Conservative MP embroiled in a financial misconduct scandal. The attacker published three satirical tweets about the allegations before they were deleted, though screenshots circulated online. The department confirmed the breach, secured the account promptly, and launched an investigation to determine the intruder's origin. The incident disrupted official communications and exposed reputational risks during a politically sensitive period involving the Culture Secretary's ethics controversy.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 7, 2014, the verified Twitter account of the United Kingdom’s Department of Culture, Media and Sport (@DCMS) was compromised by an unauthorized party. The attacker posted three tweets referencing Maria Miller, a Conservative Party politician serving as Culture Secretary and Member of Parliament since 2005. The first tweet stated, "Seriously though guys which one of us hasn’t embezzled and cheated the taxpayer?? #FreeMariaMiller," followed one minute later by a second tweet claiming, "@Maria_MillerMP is like modern day Robin Hood, she robs the poor to help the rich." A final message declared, "Is Maria @Maria_MillerMP guilty? We will let the public decide." These posts directly referenced ongoing allegations that Miller had avoided taxes by re-designating her second home as her primary residence before its sale. The tweets remained visible for a short period before DCMS officials deleted them, though Twitter users preserved evidence through screenshots.
The department confirmed the account hijacking to media outlet The Inquirer, stating the compromised account had been "quickly secured" following the incident. DCMS representatives did not publicly comment on the tweets themselves but acknowledged the breach had occurred. An internal investigation was initiated to determine the intrusion method and responsible party, with no immediate conclusion about whether the attacker was an external threat actor or an insider with account access. The incident created reputational exposure risks by associating official government communications with politically charged statements about a cabinet member under ethical scrutiny. The rapid deletion of tweets and account recovery limited the duration of unauthorized messaging, though public dissemination of screenshots extended the incident's visibility beyond the initial compromise window.