Cyber Incident Victim: People's Republic of China
Date:
Sep 2020
Location:
United Kingdom
Summary
The Twitter account of China's UK ambassador was compromised by unauthorized actors who posted content promoting an adult entertainer and sharing messages critical of Chinese foreign policy. The embassy condemned the attack as the work of "anti-China elements," demanded an investigation from Twitter, and restored control of the account, which subsequently resumed normal operations including promotion of Huawei-related material.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 9, 2020, the verified Twitter account of China’s Ambassador to the United Kingdom, Liu Xiaoming (@AmbLiuXiaoMing), was compromised by unauthorized actors. The attackers altered the account’s behavior to post content sharply inconsistent with the ambassador’s official diplomatic role. This included publicly expressing admiration for a tweet featuring an adult entertainer and retweeting messages critical of Chinese foreign policy. The breach represented a significant deviation from the account’s standard communications, which typically focused on promoting China’s diplomatic agenda and bilateral relations. The incident unfolded over several hours, during which the unauthorized users leveraged the compromised platform to disseminate messages contradicting Beijing’s official positions. Embassy officials detected the anomalous activity and initiated account recovery procedures promptly.
The Chinese Embassy in London regained control of the account within hours of the initial compromise. Upon restoring access, Ambassador Liu posted a defiant message stating, “A good anvil does not fear the hammer,” while the embassy issued an official statement condemning the breach as a “vicious attack” by “anti-China elements.” The embassy formally requested that Twitter conduct a thorough investigation into the incident, emphasizing the perpetrators had employed “despicable methods to deceive the public.” Normal account operations resumed shortly thereafter, with the ambassador sharing promotional content about Huawei-commissioned research on UK economic impacts. The incident highlighted operational vulnerabilities in diplomatic social media management, particularly given Twitter’s official ban in China, which requires embassy personnel to circumvent national restrictions to maintain the account. No technical details regarding the attack vector or attribution beyond the embassy’s generic “anti-China elements” description were disclosed publicly.