Cyber Incident Victim: Telethon
Date:
Oct 2014
Location:
Australia
Summary
The Instagram account for an Australian charitable fundraising event was hijacked by an unknown individual who demanded a ransom to return control, deleting event-related images and causing a loss of over 1,000 followers. The attacker likely gained access by guessing the account password, exploiting the absence of two-factor authentication. Supporters assisted in recovering the account, prompting implementation of stronger credentials and security measures to prevent future compromises. The incident disrupted the organization's social media presence shortly after achieving a record fundraising total.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 30, 2014, the official Instagram account of Telethon, a 48-hour charitable fundraising event in Western Australia benefiting children’s charities, was compromised by an unidentified individual. The hijacking occurred on Sunday evening immediately following the conclusion of the event, which had set a record by raising over AUD 25 million (USD 22.2 million/EUR 17.4 million). The attacker gained unauthorized access by successfully guessing the account’s password, exploiting the absence of two-factor authentication (2FA) protections. Upon seizing control, the perpetrator issued a ransom demand of AUD 1,000 (USD 890/EUR 700) for returning the account to its legitimate owners. Concurrently, the hijacker began systematically deleting images specifically related to the fundraising campaign, erasing visual documentation of the charitable activities. This unauthorized content removal persisted until recovery efforts commenced.
Telethon’s general manager, Steve Mummery, confirmed the incident resulted in a measurable decline in the account’s follower base, with over 1,000 users unfollowing the profile by the following Monday. Supporters of the charity played a critical role in restoring access by directly contacting Telethon’s management with the compromised password, enabling account recovery. Post-incident, Telethon implemented enhanced security measures, including a stronger password and the activation of two-factor authentication to prevent future unauthorized access. The hijacking disrupted the organization’s post-event social media engagement during a period of heightened public visibility following their record-breaking fundraising achievement. No evidence suggests the attacker accessed financial systems or donor data, with impacts confined to the Instagram account’s operational integrity and follower engagement metrics.