Concejo Municipal de La Ceja del Tambo

Summary

The official Instagram account of the Concejo Municipal de La Ceja del Tambo was compromised by unknown actors who gained unauthorized access and took control of the account. Despite multiple recovery attempts, the institution was unable to regain access, and evidence suggested the cyberattack was a deliberate and planned act against the municipal body rather than an isolated incident. The attackers allegedly engaged in serious criminal activities, including unauthorized access to computer systems, data alteration, and identity theft. In response, the Concejo announced that the relevant information would be forwarded to the competent authorities for investigation and created a new official Instagram account to continue its public communications.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 1, 2025, the Concejo Municipal de La Ceja del Tambo, a municipal council located in the municipality of La Ceja in the department of Antioquia, Colombia, publicly disclosed that its official Instagram account had been compromised in a cyberattack. According to the statement issued by the council, unknown actors gained unauthorized access to the institution's Instagram profile, resulting in the complete loss of administrative control over the account by the council's legitimate operators. The disclosure framed the incident not as an opportunistic intrusion but as a deliberate, coordinated action, indicating that the perpetrators had executed the attack with prior planning and a specific objective directed at the institutional presence of the municipal body on the social media platform.

The council's official communication described the nature of the compromise in precise terms, identifying several categories of illicit conduct associated with the intrusion. These included unauthorized access to computer systems, the alteration of data within the compromised account, and the usurpation of identity, the latter suggesting that the attackers had assumed the digital persona of the municipal council to interact with followers, post content, or conduct other actions under the institution's name. The council emphasized that, despite repeated and sustained efforts undertaken after the discovery of the breach to restore administrative access through official recovery channels provided by the social media platform, those attempts had not succeeded at the time of the public statement. The persistent inability to regain control, combined with the patterns of activity observed on the account following the compromise, led the institution to conclude that the incident represented a planned act against the institutionality, rather than an isolated event stemming from a leaked credential or a one-time technical failure.

In direct response to the loss of the original account, the Concejo Municipal announced the creation of a replacement official Instagram account under the handle @concejolacejaoficial. This measure was intended to restore the institution's ability to communicate with citizens through the same social media channel that had been used prior to the incident, while preserving the continuity of public outreach in the face of the ongoing compromise of the original profile. The council did not indicate in its statement whether content had been removed from the original account, whether followers had been migrated or notified through the platform's own mechanisms, or whether any posts had been issued by the attackers during the period in which the council lacked administrative access. The scope of the attacker actions on the platform, beyond the initial unauthorized access and subsequent alteration of account data, was not detailed in the public communication.

Beyond the immediate operational response of establishing a new social media presence, the council announced that the matter had been escalated to the competent authorities for formal investigation and potential criminal prosecution. The institution stated that the evidence gathered regarding the intrusion, including the observed activities on the compromised account and the technical indicators associated with the unauthorized access, would be handed over to the relevant judicial and law enforcement bodies. By explicitly categorizing the attackers' conduct as involving serious criminal offenses, the council signaled its intention to pursue the incident through legal channels rather than relying solely on internal or platform-level remediation. The statement did not name any specific threat actor, group, or individual suspected of being responsible, nor did it indicate whether the attack had been linked to any broader pattern of cyber incidents affecting other municipal entities in the region or the country.

The incident, as reported, centers on the compromise of a single social media account belonging to a municipal government body, with no mention in the available source material of broader impacts on the council's internal information systems, networks, databases, or other digital infrastructure. The disclosure focused exclusively on the loss of the Instagram account and the institutional response, without providing technical details regarding the vector of the initial compromise, such as phishing, credential reuse, exploitation of a platform vulnerability, or insider involvement. The date on which the unauthorized access first occurred, the date on which the compromise was detected by the council, and the duration of the period during which the attackers maintained control of the account were not specified in the public statement captured in the available reporting.

The official communication from the Concejo Municipal de La Ceja del Tambo, as covered by the local outlet Entre Ceja y Ceja, constituted the institution's first public acknowledgment of the incident and served simultaneously as a notice to the citizenry regarding the change in the official social media handle, as a formal declaration of intent to pursue legal action, and as a characterization of the attack as a directed action against the institutional body. The creation of the @concejolacejaoficial account marked the transition from the compromised digital identity to a newly established one under the council's control, while the referral of the case to the competent authorities initiated the formal investigative and judicial process that would follow the public disclosure of the cyberattack.

Sources

Sources available to members: 1 source.