Cyber Incident Victim: National Football League
Date:
Jan 2020
Location:
United States of America
Summary
A hacking group compromised social media accounts belonging to multiple National Football League teams and the league itself, gaining unauthorized access to Twitter, Facebook, and Instagram profiles. The attackers briefly controlled accounts of seven teams—including the Dallas Cowboys, Green Bay Packers, and Kansas City Chiefs—along with the NFL's official accounts, collectively impacting tens of millions of followers. The incident involved posting promotional content by the group, which claimed the intrusions to demonstrate security vulnerabilities. This followed similar breaches targeting other high-profile individuals' accounts earlier that week. Account access was restored within hours, with no reports of persistent compromise or data theft beyond the temporary takeover.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 22, 2020, the OurMine hacking group resumed public activity after a hiatus since 2017 by compromising high-profile social media accounts, beginning with Facebook co-founder Eduardo Saverin. The campaign escalated on January 27 when the group simultaneously hijacked official accounts of multiple National Football League entities across Twitter, Facebook, and Instagram platforms. Confirmed victims included the Dallas Cowboys (Instagram/Facebook), Buffalo Bills (Instagram/Facebook), Houston Texans (Facebook), Minnesota Vikings (Instagram/Facebook), Kansas City Chiefs (Twitter), Green Bay Packers (Twitter/Facebook), and the NFL's primary Twitter and Facebook accounts. Attackers maintained control for approximately two hours, during which they used the compromised accounts to promote their activities via OurMine's Twitter feed before the platform suspended their account. The collective follower count across all breached NFL-related accounts exceeded tens of millions.
Prior to targeting the NFL, OurMine had compromised accounts belonging to Will Smith (FooVR CEO), Bobby Berk (Queer Eye star), Enrique Hernández (LA Dodgers player), Matt Raub (film producer), and the Dave Moss YouTube channel between January 22-27. The group's operational pattern involved brief account takeovers without prolonged access or overtly destructive actions. No data theft or financial motives were indicated in available reports. The NFL and affected teams regained control of their accounts within hours, though the incident exposed systemic vulnerabilities in social media credential management across high-profile organizations. OurMine's public statements framed the attacks as demonstrations of inadequate security practices rather than financially motivated operations.