The league and scores of teams were caught off-guard by the re-emergence of an infamous hacking group
Fifteen National Football League (NFL) teams, including this year’s Super Bowl contenders the San Francisco 49ers and Kansas City Chiefs, have had their social media accounts hacked. To add insult to injury, the NFL’s official account on Twitter was also hijacked, which isn’t the first time this has happened. A hacker collective that calls itself OurMine has claimed responsibility for the incidents.
All the account takeover attacks appear to have taken place over the span of a few hours on Monday. According to the group’s tweets, they were able to hijack the Twitter, Facebook and Instagram accounts of some of the teams. The affected accounts had their profile photos, Twitter header, name and even in some cases, their bio deleted. Many accounts contained some of these now-deleted messages, shared by NFL reporter Dov Kleiman:
The twitter accounts for the @NFL, @Chiefs, @packers and @ChicagoBears got hacked. pic.twitter.com/7Ps2kINm4b
— Dov Kleiman (@NFL_DovKleiman) January 27, 2020
Facebook and Twitter provided The Hill with statements, noting that they were investigating the incidents. Another statement by Twitter for Bloomberg elaborates that the hack originated through a third-party platform, although there are no details as to how exactly the attacks unfolded. Currently, all accounts have been restored and bear no signs of the attack.
The timing of these attacks doesn’t seem random and may be seen as a bid to boost the group’s notoriety, as the week leading up to Super Bowl Sunday is one of the most media-heavy weeks.
Apologies that our account was compromised this morning. We’re back in the game & ready for the Pro Bowl. ?⬇️
— Chicago Bears (@ChicagoBears) January 26, 2020
The collective has hit popular social media accounts before. Their long list of victims includes Spanish soccer teams Real Madrid and FC Barcelona, entertainment giants Netflix and Marvel, as well as tech titans, such as Google CEO Sundar Pichai and Twitter co-founder Jack Dorsey.
Account takeover attacks often leverage credential stuffing, an automated method that deploys bots for login attempts. Using stolen or spilled access credentials that belong to one account in order to break into other accounts, the bots will hammer the sites with login attempts until they hit on the right combination.
You can mitigate the chances of having your accounts hacked by using two-factor authentication (2FA) wherever the option is available. Most services offer 2FA as an extra security layer against exactly the types of attacks the NFL and its teams suffered. Twitter, Facebook and Instagram offer several 2FA methods. If you have the sudden urge to double down on your security and enable the option on your accounts, you can refer to our recent article that explains the ins and outs of 2FA.
