Hartware MedienKunstVerein

Summary

The Hartware MedienKunstVerein experienced a complete takeover of its Instagram account (@hmkv_de) by hackers, rendering the organization unable to access or locate the account under its original name. Unauthorized messages containing links were potentially distributed from the compromised channel, though other social media platforms remained unaffected. The organization collaborated with cybersecurity experts, engaged law enforcement, filed a police report, and repeatedly contacted Meta's support team to address the breach. Full control of the account was eventually restored, eliminating further risks of unwanted phishing communications and allowing normal operations to resume securely.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 31, 2022, Hartware MedienKunstVerein (HMKV) publicly disclosed a complete takeover of its Instagram account (@hmkv_de) by unauthorized actors. The hackers gained full control of the account, rendering it inaccessible to HMKV and making it unfindable under its original handle. The attackers potentially renamed the account, raising concerns that they might use the compromised channel to distribute phishing links or fraudulent messages impersonating the organization. HMKV warned followers to exercise caution, advising them not to interact with suspicious communications originating from the account and to report any such messages directly to Instagram as scams. The incident exclusively affected the Instagram account, with no compromise detected across HMKV’s other social media platforms. The organization noted similar attacks targeting peer institutions, suggesting a broader pattern of targeting cultural entities.

HMKV initiated a multi-faceted response, engaging cybersecurity experts, filing a police report, and repeatedly contacting Meta’s support team to regain control. By February 8, 2022, HMKV successfully restored full access to the account, confirming the elimination of unauthorized access and the cessation of malicious messaging capabilities. The account’s original functionality and security were reinstated, allowing HMKV to resume normal operations and audience engagement. No direct reports of harm to followers were acknowledged, though the organization reiterated its hope that no users were adversely impacted. HMKV publicly thanked colleagues for their collaborative support during the recovery process, emphasizing the restored ability to share institutional updates and interact safely with its community through the platform.

Sources

Sources available to members: 1 source.