“Extremely worrying” breach hits official channels
An Garda Síochána has regained control of its official X accounts after a security breach turned the force’s primary communication channels into a vehicle for cryptocurrency promotion. The incident, which began at approximately 11:00 p.m. on Wednesday, saw the @GardaInfo and @GardaTraffic profiles compromised by third parties. A spokesperson confirmed the breach on Thursday morning, approximately 12 hours after the unauthorized access began.
Hijacked accounts rebrand for crypto scheme
The breach impacted a combined audience of more than 900,000 followers. According to reports, the @GardaInfo account was rebranded to masquerade as a support profile for a digital wallet, while the @GardaTraffic account had its profile picture stripped. In a clear sign of the attackers’ location, both profiles had their settings updated to Amsterdam, the Netherlands.
The hackers utilized the official handles to publish hundreds of posts, tagging individual users and soliciting interest in a cryptocurrency wallet application. These posts promised users an “allocation” of XRP, a common tactic in automated spam campaigns. XRP is primarily utilized within the finance sector by investors, fintech firms, and payment providers. While the @GardaInfo handle was altered to @HelpXaman, the @GardaTraffic account, which provides road safety updates to its 600,000-plus followers, remained otherwise visually unchanged aside from the removed profile image. The @GardaInfo account, which has over 298,700 followers, later had its name changed to a single full stop.
Cyber Crime Bureau launches investigation
The Garda National Cyber Crime Bureau is now leading an investigation into the intrusion. While the breach was significant, the force issued a statement clarifying that the incident was contained entirely within the X platform. An Garda Síochána confirmed they are “satisfied that there is no unauthorised access with any Garda systems and that there is no loss or impact on any Garda data.”
Account recovery and public safety
Despite the successful recovery of the accounts, they will remain inactive for the coming days to preserve evidence for the ongoing criminal inquiry. X has already flagged several of the malicious posts, noting they were linked to other suspended profiles—a standard automated response to such activity. Gardaí stated they are currently working with the platform to determine how the unauthorized access occurred. Official accounts on other platforms, including Facebook and Instagram, remained unaffected and continued to operate as normal.
Olga Cronin, head of policy at the Irish Council for Civil Liberties, described the event as “extremely worrying.” She noted that because state agencies are entrusted with sensitive information, it is unclear how the accounts were taken over or the full extent of the exposure. She added, “An Garda Síochána and X should explain to the public what has happened as soon as is practicable, in order to address public concern.”
Official guidance for the public
An Garda Síochána has issued a firm warning to the public: do not interact with any content posted during the window of unauthorized control. Users are also cautioned to disregard any other accounts currently purporting to be the official Garda profiles. As the investigation continues, the force maintains that no internal systems were accessed, limiting the damage to their public-facing social media presence. Regarding the ongoing inquiry, officials noted, “As this security breach is now subject of a criminal investigation An Garda Síochána is not making any further comment at this time.”
Keep reading