Irish police force has its Twitter hacked in cryptocurrency scam

There must have been red faces in the social media department of Ireland's police headquarters after two of its accounts were hijacked this week.

The official @GardaInfo and @GardaTraffic Twitter accounts of Garda Síochána were accessed by an unauthorised third party who posted cryptocurrency-related messages on Wednesday evening, potentially reaching hundreds of thousands of users.

The messages claimed that followers were eligible to claim free cryptocurrency through an airdrop. However, victims who followed the link could potentially be tricked into handing over the keys to their cryptocurrency wallet, and end up with their savings drained.

The problem, however, is not just that a hacker found themselves with the ability to post fraudulent messages posing as the Irish police. If an unauthorised person was able to publish unauthorised posts from the accounts they may also have been able to access direct messages (DMs) which could contain sensitive personal information from members of the public.

Speaking to the Belfast Telegraph, a police spokesperson attempted to dampen fears that sensitive information could have been compromised:

"An Garda Síochána is satisfied that there is no unauthorised access with any Garda systems and that there is no loss or impact on any Garda data."

Scammers like to hijack established accounts with a large followers as they are both more likely to be trusted, and provide a rapid route to reach a significant number of potential victims. The @GardaTraffic account has over 600,000 followers, and is normally used by Irish police for traffic and road safety updates, while the @GardaInfo account has almost 300,000 followers.

The Garda says that is carrying out an internal investigation into what may have happened, and is working "with the X platform to understand how this unauthorised access has occurred."

The Garda is not the only police force to have ever suffered a security breach on its Twitter account.

For instance, in 2019 the UK's Metropolitan Police had its account hijacked (as well as part of its website) by hackers who posted explicit messages calling for the release of London-based rapper "Digga D". Two men were subsequently charged in connection with the hack.

Five years before, the social media accounts of Dubai police were hacked by an Anonymous-affiliated group calling itself HorsemenLulz, who claimed the UAE's police service was “spying on you”.

In 2022, the official Twitter account of the Philadelphia Police Department was compromised and used to post what appeared to be a series of adverts targeting businesses.

There are a number of ways in which malicious hackers can gain access to accounts - including through the use of phishing emails and password-stealing malware, as well as exploiting the common habit of users choosing non-unique passwords that they have used elsewhere.

The advice of cybersecurity experts remains to protect accounts with multi-factor authentication, to always use unique, strong passwords, and to review which third-party apps may have been granted access to accounts.