Journalist Nelson Bocaranda’s Twitter account was compromised via SIM swap
On May 6, 2016, the Twitter account of Venezuelan journalist Nelson Bocaranda, founder of Runrun.es, was hijacked by unauthorized individuals through a SIM swap attack: They requested a copy of the journalist’s SIM card from the carrier Movistar using a forged letter to “replace” it, thereby bypassing Twitter’s two-step verification by receiving the code on the cloned number. The attackers deleted his tweets, posted messages falsely linking him to the U.S. government and the CIA (for example, “I confess and declare myself a CIA agent”), exposed private messages, and changed his username from @nelsonbocaranda to @nelsonbocarnda. The journalist, who had more than 2 million followers, regained access to his account about 30 hours later. This was the second time his account had been hacked, following a previous incident in July 2014.
Impact details
Nelson Bocaranda lost control of his Twitter account due to an abuse of the recovery process involving SIM card spoofing; the attackers deleted posts, published fake messages, changed the username, and made private messages public.
Classification & severity
- Category
- Intrusions
- Subtype
- sim swap social media account takeover
- Confidence
- High
Sources document the compromise of Nelson Bocaranda’s Twitter account via a “SIM swap,” the deletion of posts, fake messages, and the disclosure of private messages.
Severity assessment
Medium- Functional impact
- Degraded (non-critical)
- Information impact
- Sensitive personal data
- Affected scope
- Single user
- Critical service
- None
- Public confidence
- Limited
- Recoverability
- Regular
Report on a high-profile journalist targeted via SIM swapping, resulting in the exposure of private messages and posing a risk to sources or contacts.
Timeline
Using a SIM swap on Movistar, attackers bypassed two-step verification and took control of Nelson Bocaranda’s Twitter account at noon on Friday, May 6, 2016.
The attackers delete tweets, expose private messages, and post false messages linking the journalist to the CIA and the U.S. government.
Venezuelan media outlets (La Patilla, El Estímulo, Runrun.es) and free speech organizations (IPYS, Espacio Público) are reporting the hack.
Bocaranda regained access to his account about 30 hours after the attack.