Cyber Incident Victim: The Harvard Crimson
Date:
May 2017
Location:
United States of America
Summary
The Harvard Crimson experienced unauthorized access to its website, resulting in defacement with satirical content targeting Mark Zuckerberg during his visit to the university. The homepage displayed fabricated articles mocking Zuckerberg's name and appearance, accompanied by altered images. The breach caused intermittent site unavailability, disrupting normal operations. The student newspaper promptly acknowledged the incident, confirming the unauthorized alterations and initiating repairs. Individuals falsely claiming to be the "Winklevink twins" contacted media outlets, denying responsibility while humorously attributing the hack to Zuckerberg or members of The Harvard Lampoon, though no credible attribution was established. The incident occurred amid commencement events but did not involve substantive data compromise beyond temporary service disruption and reputational impact.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 25, 2017, coinciding with Facebook CEO Mark Zuckerberg’s commencement address at Harvard University, The Harvard Crimson’s website experienced unauthorized alterations. An unidentified individual or group gained control of the student newspaper’s homepage, replacing legitimate content with satirical articles mocking Zuckerberg. Headlines included “MARK ZOINKERBURG AT IT AGAIN,” “BREAKING: Mork Zinkeltink Zonks all over the Internet,” and “OOPS: MINK PINKLEBINK ACCIDENTALLY ‘LIKES’ OWN COMMENCEMENT SPEECH.” Accompanying imagery depicted Zuckerberg with distorted facial features, specifically lacking eyebrows and displaying abnormally small teeth. The compromised site experienced intermittent downtime, though archived records confirmed the defaced content had been publicly visible. At least one linked article in the “most read” sidebar consisted of a single sentence, though most altered headlines lacked substantive articles. The Crimson’s leadership detected the breach promptly, issuing a public statement acknowledging the unauthorized access and their efforts to restore normal operations.
The Crimson’s president, Derek Choi, formally disclosed the incident via email to Gizmodo on the same day, confirming the website had been altered by an unauthorized user and that repairs were underway. Approximately two hours after initial media coverage, two individuals identifying themselves as the “Winklevink twins” contacted Gizmodo by phone, denying responsibility for the hack. They humorously attributed the breach either to Zuckerberg himself—referencing a fictionalized, misspelled version of his name—or to members of The Harvard Lampoon, a rival student humor publication they praised as “geniuses.” The callers explicitly distanced themselves from the Lampoon while reinforcing the satirical tone of the incident. The website’s defacement temporarily disrupted access for readers during a high-traffic period coinciding with Harvard’s commencement events, though full functionality was restored following technical remediation by The Crimson’s staff. No additional operational impacts, data breaches, or threat actor motives beyond the public prank were disclosed in available reports.