SEC confirms Twitter account was targeted in SIM card swap attack, has re-enabled multi-factor authentication

The U.S. Securities and Exchange Commission (SEC) issued a statement on the 22nd, explaining the false tweet posted on Twitter just before the approval of a Bitcoin spot ETF, where SEC Chairman Gary Gensler was accused of market manipulation.

SEC: Twitter Account Hacked in SIM Card Swap Attack

According to a report from The Block, the SEC claims that unauthorized parties took control of the SEC's Twitter account by executing an apparent SIM card swap attack.

A spokesperson stated:

The compromise occurred through the telecommunications operator, not the SEC's systems, and at the time, SEC staff did not detect any indication that the unauthorized party gained access to the SEC's Twitter account. The spokesperson then reset the password for the SEC's Twitter account.

The spokesperson emphasized that they are currently collaborating with the SEC's Inspector General's Office, the FBI, CFTC, DOJ, and other law enforcement entities to determine how the unauthorized party convinced the telecom provider to change the number and how they obtained the associated phone number of the SEC account.

SEC Had Disabled Multi-Factor Authentication for Months

A spokesperson for the SEC noted:

The multi-factor authentication for the SEC's Twitter account was disabled in July of last year due to issues accessing the Twitter account at the time. Consequently, it remained disabled until the account was compromised on January 9th, when SEC staff re-enabled it.

The spokesperson also mentioned that all social media accounts under the SEC have now activated multi-factor authentication.

SIM Card Swap Attack (SIM Swapping)

Known as "SIM card swap attack" or SIM card fraud, criminals typically gather specific personal information of their targets and then, after deceiving telecommunications service personnel, transfer the target user's phone number to a SIM card under their control.

This essentially gives them control of the "user's phone," often used to access financial accounts and cryptocurrency wallets, but this is not commonly seen in Taiwan.

friend.tech reported multiple users being hacked, cybersecurity agencies cautioning against SIM card swap attacks.