A British man has been arrested in the coastal resort town of Estepona in Andalusia, after being charged in the United States in connection with a high-profile Twitter hack last summer. The hack had compromised the social media accounts of prominent politicians, celebrities and technology moguls, the US Justice Department said on Wednesday.
Joseph O’Connor, 22, was arrested on charges of involvement in a July 2020 hack of more than 130 accounts, and of hacks that prosecutors said took over TikTok and Snapchat accounts, including ‘one of the most viewed and followed’ TikTok stars. Prosecutors also accuse O’Connor of cyberstalking a juvenile. He was arrested by Spanish National Police at the request of the FBI.
The criminal complaint had been filed in a federal court in the Northern District of California. It did not specifically identify the popular TikTok personality whose account was compromised, but the date in the charging document matches up with the date that Addison Rae, who has around 82 million followers, revealed that she had been hacked.
The complaint charges O’Connor, who went by the online handle PlugWalkJoe, with crimes including cyberstalking, making extortive and threatening communications and intentionally accessing a computer without authorisation. He has denied wrongdoing, according to reports.
During the high-profile security breach a year ago, fake tweets were sent from the accounts of Barack Obama, Joe Biden, Mike Bloomberg and a number of tech billionaires including Amazon’s then-CEO Jeff Bezos, Microsoft co-founder Bill Gates and Tesla CEO Elon Musk. The bogus tweets asked followers of the high-profile accounts to send Bitcoin payments. O’Connor is at least the fourth suspect charged in connection with the hack.
Following the incident, Twitter confirmed that a co-ordinated social engineering attack had allowed criminals to post tweets from celebrities’ accounts offering to send $2,000 for every $1,000 sent to a Bitcoin address.
A Florida teenager was sentenced in March to three years in prison for his role in the hacking operation. Graham Ivan Clark pleaded guilty to multiple fraud charges as part of a deal with Hillsborough County prosecutors.
Andrew Warren, the Florida state attorney who prosecuted Clark, said in an interview Wednesday he still considers him to be the mastermind of the plot.
Warren said Clark was involved in the social engineering and hacking to get access to the Twitter accounts, as well as selling the accounts and sending out the tweets. ‘And he’s the one who collected six figures worth of Bitcoin,’ Warren said.
The complaint against O’Connor on Wednesday said he conspired with Clark and others to benefit from the hack of Twitter accounts. Online chats obtained by investigators show that during the hack O’Connor expressed interest in buying some high-profile accounts, including Donald Trump’s.
Prosecutors have said the plot originated in an online forum for people looking to obtain social media usernames that carry some prestige. Such coveted usernames, known as ‘OG’ or ‘original gangster’ accounts, are typically short and might have been created when Twitter was in its earliest stages more than a decade ago.
There’s an underground market for stealing and trading the sought-after handles on Twitter and other social media sites such as Instagram or the gaming worlds of Minecraft and Fortnite.
Twitter, Instagram and TikTok earlier this year said they were cracking down on accounts affiliated with the theft and sale of OG usernames.