Cyber Incident Victim: Swedish House Mafia
Date:
Dec 2015
Location:
Sweden
Summary
The electronic music group's official Facebook page was compromised, resulting in unauthorized modifications including an updated header photo and explicit posts referencing a third-party tour. Fans alerted former members to the suspicious activity, prompting deletion of the inappropriate content. The breach was confirmed via the group's Twitter account, though no statements addressed concurrent reunion speculation stemming from the header change. The incident demonstrated unauthorized access to dormant social media assets, leading to temporary dissemination of unrelated explicit material before mitigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 10, 2015, unauthorized activity occurred on Swedish House Mafia’s official Facebook page, which remained active despite the electronic dance music group disbanding in 2013. The incident began when the page’s header photo was updated, prompting fan speculation about a potential reunion of former members Steve Angello, Axwell, and Sebastian Ingrosso. This anticipation shifted to confusion when explicit posts referencing Cyrus’ sexually themed "Milky Milky Milk Tour" appeared on the profile, contradicting the group’s typical content. Fans quickly identified the discrepancy, suspecting a security breach, and directly alerted the former members through online channels. The compromised account posted multiple inappropriate updates before intervention occurred. Swedish House Mafia’s official Twitter account acknowledged the breach the same day, stating, "Our facebook was hacked. Someone must have been bored 🌑🌑🌑," confirming unauthorized access. The group did not disclose the duration of the compromise or the exact method of infiltration.
The hack caused immediate disruption, misleading followers and generating concerns about the page’s integrity. Explicit content was swiftly removed following fan notifications, indicating a responsive mitigation effort by the group or its representatives. No additional systems or social media accounts beyond the Facebook page were confirmed affected. The incident amplified existing reunion rumors but received no substantive commentary from the former members regarding either the breach or speculation about reformation. Operational control of the Facebook page was restored post-deletion of the malicious posts, with no further unauthorized activity reported in the immediate aftermath. The group’s public communication remained limited to the singular Twitter post acknowledging the breach, leaving technical details and long-term security adjustments undisclosed.