NHS executive Helen Bevan had her two Twitter accounts, with nearly 140,000 followers, stolen by hackers and want to promote fake PlayStation 5 sales.
She now has the accounts back but has received dozens of messages from people that fell for the scam.
Ms. Bevan also paid money to someone who said they might help – but they clothed to be a scammer too.
She said she wanted to spotlight the importance of additional security measures.
NHS Horizons chief transformation officer Ms. Bevan mistakenly thought she had activated two-factor authentication (2FA), which needs account-holders to use two methods to log in, the second often involving a code sent by text or email.
However, providing those contact details doesn’t automatically activate 2FA, therefore the hackers were ready to simply change the e-mail address and telephone number she had linked to the accounts once that they had cracked her password.
One was a knowledgeable account with 97,000 followers discussing Ms. Bevan’s work, and therefore the other one was about her cat, an area “celebrity”, which was followed by 36,000 people. The hackers deleted all of her original tweets, unfollowed the people she was following, and renamed the accounts.
It happened the day before Ms. Bevan was due to lead a web event for thousands of individuals, and she or he had encouraged her audience to use Twitter as their discussion tool.
Facing this pressure, she felt panicked that her account wasn’t under her control.
“I was the social media heartbeat of this event, I didn’t know what to do,” she said.
“Someone said, ‘You have a basic choice, you’ll await Twitter to offer your account back otherwise you can find someone to assist you.'”
As her friends and network were tweeting about the hack, offers of help flooded in and she or he chose someone who promised to possess the accounts back within 25 minutes reciprocally for a fee of £110.
“I don’t think he did anything, he kept sending me films of computer files whirring, saying this is often me doing all of your work,” she said.
“Then he said he had got it back, but Twitter had changed the verification and he needed an additional $100, then he wanted a service charge they feed on desperate people.”
She didn’t pay anything further and accepts that the cash she handed over is lost.
After two days, Twitter itself restored the accounts for her.
When she accessed them, she found dozens of direct messages from people asking about PlayStation 5 orders.
She says she has no idea what percentage of fake sales were generated by the scammers but the PS5s were being advertised at upwards of $450 (£320).
“They were following Walmart, Dixons, PC World, Target,” she said.
“They would await them to tweet about PS5s then reply, saying we have got PS5s available now, DM [direct message] me.”
There were also Fleets – temporary Twitter posts – featuring photos of PlayStation boxes.
Ms. Bevan later had to elucidate to all or any who messaged her, having purchased games consoles, that she was also a victim of the scam.
She said she wanted to share her story as a warning to others.
“There are things I now know that I wish I’d known – everybody should have two-factor authentication, it’s critical that you simply put that on,” she said.
“Also, under no circumstances, albeit you’re desperate, don’t attend one among these services that claim they’ll get your account back in half-hour and stuff – I feel they’re likely to be a scammer.
“The only thing you’ll do is undergo Twitter. Do it one step at a time.”
Lisa Forte, from Red Goat Cyber Security, said having all the safety settings enabled on all social media accounts is ” essential”.
“This means employing a complex and long password, turning on two-factor authentication and, within the case of Twitter, enabling the password-reset protection setting,” she said. “Attackers are trying to find easy targets. they need amazing eco-systems of companies that allow them to require over y