Cyber Incident Victim: Cricket South Africa
Date:
Dec 2015
Location:
South Africa
Summary
The Cricket South Africa Facebook page was compromised by hackers who posted racist and sexually explicit content for approximately two hours, impacting its over 3 million followers. The organization acknowledged the breach on Twitter, apologized for the inappropriate posts, and worked to resolve the issue, while fans expressed both criticism and amusement in response to the hijacked content.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 9, 2015, the official Cricket South Africa Facebook page, with over 3 million followers, was compromised by unidentified hackers. The attackers posted a series of inappropriate links over a two-hour period during the morning, distributing adult-oriented and racially charged content. Shared posts included sensationalized headlines such as "Kendall Jenner puts her NIPPLES and BUTT on display in See Through Outfit!" and "A Russian Laboratory Has invented A Way to Remove The Black Skin Layer Of Black People," accompanied by images of naked or semi-naked women. Additional links promoted articles about Michael Jackson’s physical transformations and human biology during sexual activity. Followers immediately recognized the anomalous activity, flooding the page with comments criticizing the organization for the offensive material. Former South African cricketer Riki Wessels was among the first to publicly identify the breach on social media.
Cricket South Africa acknowledged the incident through an official Twitter apology that evening, stating, "We are aware that our Facebook page has been hacked & are working on resolving the issue." The organization expressed regret for the inappropriate posts and assured followers of imminent resolution. Public reactions on Twitter ranged from amusement at the absurdity of the shared content to disappointment over the racial insensitivity displayed. The hack disrupted normal page operations but did not affect other CSA social media accounts. Historical context revealed similarities to the June 2014 compromise of Linkin Park’s verified Facebook page, which similarly featured adult content spam. No technical details regarding the intrusion vector, account recovery process, or perpetrator attribution were disclosed in public statements.