The Twitter hack started with a phone call

The story

On July 15, 2020, 130 high-profile Twitter accounts were taken over, including those of Barack Obama, Joe Biden, Elon Musk, Bill Gates and Apple. They posted messages promising to double any Bitcoin sent to a certain address. People sent money within minutes.

The attackers went after Twitter’s own staff, leaving the account owners’ passwords untouched. They looked up employees on LinkedIn, found their phone numbers, and called them pretending to be from Twitter’s internal IT team. Many staff were working from home during the pandemic. The callers sent them to a fake version of the company’s sign-in page and asked for the two-factor code as it arrived.

With those accounts, the attackers reached internal tools that let support staff change any user’s account. Twitter called it a “phone spear phishing attack.” Three people were charged within weeks; the main one was 17.

Why it mattered

The attack showed that a company’s own support tools can be its biggest risk, because whoever controls them controls every customer account. The FBI opened an investigation the next day, and US senators pressed the company for answers. It also showed how quickly a few fake posts from trusted accounts could move real money.

The lesson today

A convincing phone call from “IT” beat a large tech company’s security. Callers who sound like coworkers, help desks that reset passwords on request and admin tools that many people can use are still how attackers get in. Verify the caller by calling back on a known number, and keep powerful access to as few people as possible.