Cyber Incident Victim: New York Times
Date:
Jan 2017
Location:
United States of America
Summary
The New York Times experienced a compromise of its Twitter video account by the OurMine hacker group, which posted unauthorized content including fabricated claims of a Russian missile attack against the United States. The organization promptly removed the false statements and confirmed the unauthorized access, initiating an investigation while the attackers asserted their actions were intended to test account security. This incident aligns with OurMine's pattern of targeting high-profile accounts to promote their services and highlight security vulnerabilities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 22, 2017, at approximately 9:40 AM Eastern Time, the Twitter account for New York Times Video (@nytvideo) was compromised by the hacker group OurMine. The attackers posted a fabricated news alert claiming Russia had launched a missile attack against the United States, attributing the action to a "leaked statement" from Russian President Vladimir Putin. This unauthorized tweet was rapidly deleted by the New York Times, though screenshots and reports confirmed its brief publication. OurMine subsequently claimed responsibility for the breach through additional tweets on the compromised account, stating they had "detected unusual activity" and "re-hacked" the account to verify its security status. The group also referenced their prior compromise of Sony Music’s Twitter account in December 2016, where they had disseminated a hoax about singer Britney Spears’ death.
The New York Times responded by deleting all unauthorized tweets from the @nytvideo account and publicly acknowledged the breach via a tweet confirming an investigation into the incident. No further details regarding the intrusion method or additional compromised systems were disclosed by the Times. OurMine’s actions aligned with their established pattern of targeting high-profile social media accounts to promote their self-described security testing services, though their activities typically involved cybervandalism rather than data theft. The incident temporarily disrupted the @nytvideo account’s operations but did not result in prolonged service outages or corroborated data leaks. The Times restored control of the account following the removal of the unauthorized content, with no subsequent reports of recurring breaches tied to this event.