Media companies' Twitter accounts taken over through phishing (2013) and what it shows about who knows the password

This case comes from a federal criminal complaint filed in 2014 and made public on March 22, 2016. According to the complaint, attackers in 2013 used phishing to get the Twitter (now X) logins of US media companies, then posted their own messages from those accounts. These are charges, not findings of a court.

What happened, according to the complaint

The complaint describes the group’s main method. The attackers collected email addresses of people at a target company. They sent an email that appeared to come from a trusted source and contained a link. The link opened a website that looked trusted but was under the attackers’ control. Anyone who clicked was asked for a username and password for a real system, and in the attacks that worked, at least one person entered them. The attackers then used those real login details to get in.

The complaint calls this “spearphishing”: phishing aimed at specific people or companies. Phishing means trying to get information such as usernames and passwords by posing as someone trustworthy in an email or message.

Two of the complaint’s examples involve Twitter logins at media companies:

• In May 2013, the attackers obtained, through spearphishing, the login details for the Twitter account of an entertainment news website. They then posted false messages on its feed.
• In August 2013, they used spearphishing to obtain the logins for several Twitter accounts at a daily newspaper, then posted their own messages to those feeds.

The complaint doesn’t describe the emails used in these two attacks. It says the logins were obtained through spearphishing, the method above, in which the person who knows the login enters it on the attackers’ page. Once the attackers had an account’s username and password, they could post from it.

Where the case stands

The complaint was sworn in June 2014 in federal court in Virginia and unsealed in March 2016. In May 2018, a federal grand jury there returned an indictment. The Justice Department’s own release says an indictment contains allegations and that every defendant is presumed innocent unless proven guilty in court.

Controls usually expected after incidents like this

Phishing and spoofing is the crime type the FBI’s Internet Crime Complaint Center (IC3) gets the most complaints about: 191,561 in 2025.

CISA’s guidance on phishing says not to give out personal or financial information in response to an email, including by following its links. If a request seems odd, contact the company directly, using details from past statements rather than from the message. CISA also says to check website addresses for misspellings and to use MFA (a second check beyond the password; see what is multi-factor authentication).

The FTC’s small business sheet on phishing says much the same. Look up the website or phone number of the company behind the message yourself, and call using a number you know is correct. If someone at your company falls for it, the FTC says to change the compromised passwords at once and warn colleagues, because attacks often reach more than one person. It also says to tell the company that was impersonated and report it at ReportFraud.ftc.gov.

CISA’s #StopRansomware Guide goes a step further. It recommends phishing-resistant MFA for all services, especially email and accounts that reach critical systems. CISA’s fact sheet on phishing-resistant MFA explains that a six-digit code from a phone app can be typed into a fake login page along with the password. It rates methods built on the FIDO standard, such as a physical key connected to the computer or phone, as resistant to phishing. For how QR code sign-in compares, see QR code sign-in and how well it resists phishing.

The email advice depends on each person spotting the fake every time. What the fake page can take depends on what the person knows. If several people know the brand account’s password, each of them is a way in. For giving an agency access to X without one shared login, see agency access to X and TikTok business accounts.

Questions to ask about your own setup