Cyber Incident Victim: United Nations Children's Fund
Date:
Oct 2014
Location:
Syria
Summary
UNICEF's Twitter account was compromised by the Syrian Electronic Army, which posted six tweets—three in English and three in Arabic—reporting on bomb blasts near a primary school in Homs that killed 49 children and wounded dozens. The hackers altered the account’s cover photo to support their messaging, though the attack method remained unconfirmed despite speculation of phishing. The incident leveraged the organization’s platform to disseminate claims about the explosions, which Syrian rebels were suspected of carrying out, though no group formally claimed responsibility.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 2, 2014, the Syrian Electronic Army (SEA), a hacker group supporting Syrian President Bashar al-Assad, compromised the official Twitter account of UNICEF. The attackers posted six tweets—three in English and three in Arabic—reporting on twin car bombings that killed 49 children under age 12 in Homs, Syria, the previous day. All messages contained identical content describing the attack near Akrameh al-Makhzoumi primary school. SEA altered UNICEF's Twitter cover photo during the breach and provided Techworm with a screenshot confirming unauthorized access to the account. The hackers did not disclose their intrusion methods, though the article suggested phishing as a possible attack vector. UNICEF did not issue public statements regarding account recovery efforts in the immediate aftermath according to the source material.
The hijacked tweets referenced real-world violence that occurred on October 1, 2014, when an initial parked car bomb detonated as students left school, followed minutes later by a suicide bomber in another vehicle. Syrian officials reported 56 additional casualties beyond the child fatalities, making it one of Homs' deadliest incidents in months. No militant group claimed responsibility for the physical attacks, though unnamed reports speculated about opposition forces targeting Assad's regime. SEA's digital intrusion weaponized UNICEF's humanitarian brand to amplify graphic wartime reporting aligned with their political stance. The breach demonstrated non-technical impacts by exploiting a trusted organization's platform during active conflict. Cybersecurity analysts cited in the article provided no evidence of data theft or secondary system compromises beyond the Twitter account takeover.