Cyber Incident Victim: Etherium
Date:
Feb 2022
Location:
India
Summary
The YouTube account of Sansad TV was compromised by scamsters, leading to its termination for violating platform guidelines after being renamed "Etherium," referencing a cryptocurrency. The channel's social media team restored access within hours, with YouTube addressing security threats and the Indian Computer Emergency Response Team investigating the breach. This incident follows prior compromises of government-linked accounts promoting cryptocurrency schemes, including breaches of the Prime Minister’s Twitter handle and personal website.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 15, 2022, Sansad TV's YouTube channel, which broadcasts live Indian parliamentary proceedings, was compromised by unidentified scamsters at approximately 1:00 AM local time. The attackers renamed the channel "Etherium" – matching the spelling of a prominent cryptocurrency – triggering YouTube's termination of the account for violating community guidelines. Users attempting to access the channel encountered a 404 error message stating the page was unavailable, followed by a termination notice citing guideline violations. Sansad TV's social media team detected the breach and engaged YouTube to address the security threat, successfully restoring the channel by 3:45 AM the same day. The Indian Computer Emergency Response Team (CERT-In) was notified of the compromise. YouTube initiated permanent security fixes, though Sansad TV's statement did not specify whether the attackers uploaded content or solely renamed the channel prior to termination.
The incident temporarily disrupted public access to parliamentary broadcasts and marked at least the third compromise of an Indian government-affiliated digital account linked to cryptocurrency scams since 2020. YouTube's termination reflected automated enforcement of policies against spam, deceptive practices, or financial scams, though the specific violated guideline remained unconfirmed as Google did not respond to media inquiries. Sansad TV's swift restoration within three hours limited operational impact, but the breach followed a pattern of high-profile compromises including Prime Minister Narendra Modi's Twitter account in December 2021 and September 2020, both involving fraudulent cryptocurrency solicitations. These repeated incidents highlighted ongoing vulnerabilities in official social media accounts despite prior security incidents.