Federal agents in Massachusetts are investigating a 16-year-old who they believe played a key role in a high-profile Twitter hack last month, The New York Times reported on Tuesday.
Sources involved in the investigation claim the teen helped plot and carry out major aspects of the breach, including gaining access to Twitter’s internal admin systems via social engineering attacks on its employees, according to the report.
The Times also reported that the teen has not yet been charged with any crime and that the court documents have not been made public, but an FBI spokesperson told the newspaper that agents served the teen with a warrant and raided the house in Massachusetts where he lives with his parents.
The arrest is notable given the teen’s age, especially given the arrest last month of 17-year-old Graham Ivan Clark in Tampa, Florida, as well as the Department of Justice’s announcement that it had charged 22-year-old Nima Fazeli of Orlando and 19-year-old Mason Sheppherd of the United Kingdom in connection with the hack.
State authorities in Florida will handle Clark’s case, as they have more leeway in prosecuting minors than federal authorities — a similar approach would be likely in the Massachusetts teen’s case if charges are eventually filed.
Twitter declined to comment and the FBI could not be immediately reached.
In mid-July hackers used Twitter’s internal admin tools to compromise the accounts of prominent people and companies after obtaining Twitter employees’ login credentials through various “social engineering” attacks. The compromised accounts then tweeted that they were feeling “generous” and would match people’s Bitcoin donations. The DOJ said that generated more than 400 transfers to the scammers’ cryptocurrency wallet worth more than $100,000.
Victims of the hack included former President Barack Obama, former Vice President Joe Biden, Bill Gates, Warren Buffett, Jeff Bezos, Elon Musk, Michael Bloomberg, Floyd Mayweather, Kanye West, Kim Kardashian West, Apple, Uber, and the cryptocurrency exchanges KuCoin, Coinbase, Gemini, and Binance. The DOJ said more than 100 accounts were hijacked in total.
Source: markets.businessinsider.com