Cyber Incident Victim: The Wall Street Journal
Date:
May 2014
Location:
United States of America
Summary
The Syrian Electronic Army compromised four Twitter accounts belonging to the Wall Street Journal, specifically targeting WSJ Africa, WSJ Europe, WSJ Vintage, and WSJ.D. Attackers posted derogatory content directed at an individual, including an image combining their likeness with a cockroach, accompanied by the text "@Irawinkler is a cockroach." The organization promptly detected the unauthorized access and removed the malicious posts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On May 7, 2014, the Syrian Electronic Army (SEA) compromised four Twitter accounts belonging to The Wall Street Journal. The affected accounts included WSJ Africa (@wsjafrica), WSJ Europe (@wsjeurope), WSJ Vintage (@vsjvintage), and WSJ.D (@wsjd). Attackers posted identical messages across all hijacked accounts stating "@Irawinkler is a cockroach," accompanied by an image depicting Ira Winkler's head superimposed on a cockroach's body. The derogatory content specifically targeted Winkler, a cybersecurity professional known for his work in threat analysis. The incident was first reported by Poynter, indicating rapid public awareness of the compromise.
The Wall Street Journal detected the unauthorized access promptly and removed the offensive tweets. No additional details about the duration of the compromise or other malicious activities beyond the single tweet per account were disclosed in available reports. The attack demonstrated the SEA's continued focus on compromising media organization assets to disseminate targeted messages, following their established pattern of hacktivist operations. The incident highlighted vulnerabilities in social media account security at major news organizations but did not result in disclosed operational disruptions beyond the temporary account control and defacement. WSJ restored control of the accounts without publicizing specific remediation measures taken to prevent recurrence.