Trying to sell data they claim was already stolen

Jul 6, 2020 15:06 GMT  ·  By

Hijacking a Twitter account has become a hobby for some specific groups of hackers, as it’s apparently quite easy to do this since high-profile users fail to properly secure their pages.

The latest to be targeted by hackers is none other than the Russian Foreign Ministry’s Crisis Management Center, whose Twitter account was recently compromised by an unnamed group trying to sell what they claim it was private tourist data.

More specifically, security researcher Graham Cluley reveals the breach happened on July 2 when an unexpected tweet went live of the @MID_travel Twitter account that typically retweets the posts of other Russian agencies.

However, this surprising tweet claimed the hackers were in possession of personal data related to tourist payments that were made in June 2020 on Russia’s Public Services Portal.

Account already restored

So technically, the hackers used the compromised Twitter account as an ad for this stolen data, although it goes without saying that nobody knows for sure if the tourist payment information is indeed in their possession. However, anyone could actually find out if this is true by paying 66 Bitcoin, as this is how much the hackers want for the batch of data. For what it’s worth, this means they want nearly $500,000.

Of course, the Russian authorities have already recovered the account and removed the tweet from the page, followed by a new message that details what happened.

“We regained access to the account after cybercriminals posted a message on the morning of July 2 and the message that was posted has nothing to do with the Russian Foreign Ministry. The account is now working normally,” they explained in an approximate translation.

Needless to say, the hacking group behind the attack wasn’t disclosed, and there’s a good chance more details would never be provided.