{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T09:19:40.195Z","total":1,"returned":1,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"AP Twitter account hijacked, fake White House bombing tweet jolts markets","date":"2013-04-23","date_precision":"day","victim_org":"The Associated Press","sector":"Media & Entertainment","country":"United States","primary_vector":"Spear Phishing (Email)","secondary_vectors":["Credential Phishing Portal"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media involvement was reported.","outcomes":["Credential Theft","Service Disruption"],"loss_usd":null,"loss_note":"No direct loss to AP was reported. The Dow Jones Industrial Average fell about 143 points within minutes before recovering.","records_affected":null,"threat_actor":"Syrian Electronic Army (claimed responsibility)","summary":"On 23 April 2013 the Associated Press's main Twitter account posted a false report of two explosions at the White House injuring President Obama. The Dow Jones Industrial Average dropped roughly 143 points in minutes before recovering once AP disavowed the tweet. AP said the account takeover was preceded by phishing attempts against its corporate network; the Syrian Electronic Army claimed responsibility, a claim that was not independently corroborated at the time.","how_it_worked":"Staff at AP received phishing emails aimed at the corporate network shortly before the hijack. The lure exploited newsroom urgency and normal internal circulation of story links, leading recipients toward a credential capture page. Harvested credentials gave the attackers control of the wire service's verified Twitter account, whose authority with algorithmic traders and human readers alike was the real payload. A single 12-word tweet asserting an attack on the President was enough to move equity markets before any verification could occur.","lessons":"Two-factor authentication on corporate social accounts, plus separation of newsroom publishing credentials from ordinary staff email, would have prevented a single phished mailbox from becoming a market-moving broadcast channel.","confidence":"Reported","sources":[{"title":"AP Twitter Account Hacked; Tweet About Obama Shakes Market","url":"https://www.npr.org/sections/thetwo-way/2013/04/23/178620410/ap-twitter-account-hacked-tweet-about-obama-shakes-market","publisher":"NPR"},{"title":"Hackers compromise AP Twitter account","url":"https://www.cbsnews.com/news/hackers-compromise-ap-twitter-account/","publisher":"CBS News"}],"entry_type":"incident","slug":"2013-ap-twitter-account-hijacked-fake-white-house-bombing-tweet-jolts-markets","year":2013,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2013-ap-twitter-account-hijacked-fake-white-house-bombing-tweet-jolts-markets"}]}