British Gas

Summary

The British Gas support Twitter account was compromised, leading to unauthorized tweets containing malicious links that directed users to phishing sites mimicking Twitter's login page. These fraudulent messages aimed to steal user credentials, potentially enabling further account hijacking for spam and scam distribution. The company regained control of the account after the incident, mitigating ongoing unauthorized access.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 22, 2014, British Gas's customer support Twitter account, @BritishGasHelp, was compromised by unauthorized actors. The attackers gained control of the account and posted a series of anomalous tweets containing hyperlinks, deviating from the account’s typical focus on boiler breakdown assistance and customer service inquiries. The messages included phrases such as "I’m laughing so much right now at this," "haha this tweet by you is cool," "haha I hd a strange feeling this is yours," and "lamo u got 2 see this, its awesome," each accompanied by a link. These tweets were designed to lure followers into clicking the embedded URLs, which redirected to counterfeit Twitter login pages mimicking the platform’s legitimate interface. The phishing sites aimed to harvest user credentials, enabling further account takeovers by the attackers. British Gas regained control of the compromised account later the same day, though the exact duration of the breach and the specific intrusion method were not disclosed in available reports.

The incident exposed followers of @BritishGasHelp to credential theft risks, as individuals who interacted with the fraudulent links could inadvertently surrender their Twitter usernames and passwords to the attackers. Successful phishing attempts would have enabled malicious actors to hijack additional accounts for spam distribution or scams, mirroring the compromise observed in the British Gas case. No quantitative data regarding victim counts, financial losses, or secondary compromises was confirmed in the source material. British Gas restored normal operations to the @BritishGasHelp account following the recovery, with no referenced delays in service restoration or broader system disruptions beyond the Twitter account’s temporary misuse. The company did not publicly detail additional security measures implemented post-incident, though the restoration of legitimate account activity indicated containment of the immediate threat.

Sources

Sources available to members: 1 source.