iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The August 2013 incident involved access to a Melbourne IT reseller account and changes to DNS records—not established intrusions into The New York Times’ or Twitter’s internal networks. The altered records redirected the Times’ domain and disrupted Twitter image delivery. The Syrian Electronic Army (SEA) claimed responsibility, but the Times’ chief information officer cautioned that someone might have been impersonating the group.
How the attackers gained control of the domains
Melbourne IT, the domain registrar involved, said that valid username-and-password credentials were used to access one of its resellers’ accounts. DNS records for domains managed through that account, including nytimes.com, were then changed. Melbourne IT did not establish how the credentials had been obtained or misused. Its CEO, Theo Hnarakis, said, “One of our resellers in the US was targeted and we are currently investigating how this could have happened,” and added, “I wish I could say how this occurred but I don’t want to speculate at this stage.” The Guardian’s report records those statements.
DNS tells internet systems where to send requests for a domain. Changing a domain’s records can therefore redirect visitors or make a service harder to reach even if the organization’s web servers and internal systems remain untouched. In this case, WIRED reported that nytimes.com had been set to point to a Russian hosting service displaying a defacement message, while noting there was no evidence that The Times’ internal systems had been compromised.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What the changes did to The New York Times and Twitter
The New York Times
The Times reported malicious external activity affecting its website on August 27, 2013. Because the domain’s routing information had been altered, readers could be redirected or unable to reach the usual site. That is evidence of a domain-control incident; it does not establish that attackers entered the newspaper’s newsroom systems, internal network, or web servers.
#1 Best Overall
Twitter’s image domain
Twitter said DNS records for several organizations had been modified, including twimg.com, the domain used to serve images. The company described image viewing as sporadically affected and said no Twitter user information was affected. Its statement, reproduced by TechCrunch, said the original twimg.com record was restored at 22:29 UTC. That specific time refers to restoration of the DNS record, not the moment every user’s access recovered.
What is known—and not known—about responsibility
The SEA publicly claimed the attack. However, Marc Frons, then chief information officer of The New York Times Company, described the attribution as “the Syrian Electronic Army or someone trying very hard to be them,” in an employee statement reported by TechCrunch. The reporting documents the claim, but does not independently establish who operated the account or carried out the changes.
Likewise, the available accounts do not show how the reseller credentials were obtained. Melbourne IT said it was investigating and declined to speculate. Claims that a particular person, phishing message, or malware campaign caused the account access go beyond what these reports establish.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the companies responded and when services recovered
Melbourne IT said it restored the affected DNS records, locked them against further changes at the .com registry, changed the reseller credentials, and reviewed its logs. Twitter separately reported that the original twimg.com record was restored at 22:29 UTC on August 27. The Guardian reported that The Times and Twitter were back online and operating normally by August 28, although some users continued to have access problems while DNS information propagated or cached records updated.
Rank #3
The Times also advised employees to be careful when sending sensitive emails during the incident. That was a precaution while domain control was disrupted; it is not evidence that email accounts had been accessed.
Quick Recap
Best Value
What the incident does—and does not—show
- It shows: credentials were used to access a Melbourne IT reseller account, and DNS changes disrupted or redirected services using affected domains.
- It does not show: that The New York Times’ internal network or Twitter user accounts were compromised. Twitter specifically said user information was unaffected, and WIRED reported no evidence of an internal Times compromise.
- Attribution remains qualified: the SEA claimed responsibility, but the Times’ CIO explicitly raised the possibility of impersonation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
