Menu
Browse

Cyber Incident Victim: Save the Elephants

Date:

Jul 2025

Location:

Kenya

Summary

The official Facebook pages of Save the Elephants and ElephantVoices were compromised after attackers posed as US podcast representatives to gain access under false pretences. The breach severed direct contact with hundreds of thousands of supporters, leading the organisations to collaborate with Meta to regain control and to implement stronger security protocols.

CIA Posture Motives Tactics, Techniques & Procedures
Available to members 0 motives 1 technique
Threat Actors Type Location
0 actors Available to members Available to members

Description

In the past three weeks the official Facebook pages of ElephantVoices and Save the Elephants were compromised in elaborate and well‑planned cyber attacks. The organisations have reason to believe that both were targeted by the same individuals who posed as representatives of established podcasts in the United States to gain access under false pretences. This method allowed the attackers to infiltrate the accounts and take control of the pages. The breach disrupted the direct communication channel that the organisations maintain with their supporters on Facebook. As a result the connection with hundreds of thousands of dedicated followers was severed. The organisations expressed regret for any inconvenience caused by the loss of access and the potential confusion among supporters.

Cyber Incident Image

In response Save the Elephants and ElephantVoices have been working closely with Meta to resolve the issue and regain control of their compromised accounts. They have strengthened their internal systems and implemented new security protocols to prevent similar incidents from occurring in the future. The organisations urged their followers to exercise caution when receiving messages on Facebook that claim to be from either organisation, especially those requesting donations, and to report any suspicious messages directly to them. They also advised fellow conservation NGOs to avoid engaging with any podcast‑related requests, particularly those originating from Gmail accounts, without first verifying the legitimacy of the request by contacting the podcast through another channel. For accurate updates and verified information the organisations directed supporters to their official Instagram, LinkedIn and websites, and provided contact email addresses for further inquiries.

Sources
Sources available to members
1 source