Twitter CEO Jack Dorsey's Account Hijacked via Carrier Number Takeover and SMS-to-Tweet
On 30 August 2019 the "Chuckling Squad" took over Jack Dorsey's @jack account and posted offensive tweets; Twitter blamed "a security oversight by the mobile provider" that let attackers control the phone number tied to the account.
02Deep-Dive Technical Analysis
The attackers gained control of Dorsey's mobile number through his carrier (unnamed by Twitter). Twitter's legacy SMS-to-tweet feature, inherited from its 2010 acquisition of Cloudhopper, accepted posts based solely on the sending phone number, with no password or second factor. Once the number was under attacker control, texts sent to Twitter's short code were published as @jack. No password was compromised and access was limited to posting; the account was secured within about an hour. A minor allegedly involved was arrested in November 2019.
03Vulnerability & Exploit Flow
Carrier number takeover combined with a service that treated the sending MSISDN as sufficient authentication.
04Recommended Defense & Mitigation Protocol
Carrier SIM-change/port-out PINs and stronger verification; removing SMS as an authentication or posting channel in favour of app-based or FIDO2 2FA.
05Security Impact & Geopolitical Consequence
Showed that a phone number is a weak identity credential even for a platform CEO; Twitter temporarily disabled tweeting via SMS and later allowed 2FA without a phone number.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.