Verizon-owned prominent technology site TechCrunch has become the latest victim of the OurMine hacking group.
OurMine Security appeared to gain publishing access to the site, which uses the popular content management system WordPress, and posted its now infamous message.
A post on the site under the byline of Seattle-based writer Devin Coldewey said: “Hello Guys, don’t worry we are just testing techcrunch security, we didn’t change any passwords, please contact us.”
The post was then promoted as a ticker, the top banner in red and a the main story on TechCrunch’s front page.
The OurMine posting appeared at around 12.20pm BST (7.20am ET) but was removed within two hours. It was still showing in Google’s index and cache at the time of writing.
The attack on the technology site is latest in a number of high-profile compromises by OurMine, which included the social media accounts of Twitter chief executive Jack Dorsey, Facebook CEO Mark Zuckerberg and Google boss Sundar Pichai.
OurMine also claimed responsibility last week for a DDoS attack on Pokémon Go’s servers.
The TechCrunch attack appears to have leveraged a contributor’s account, rather than a hack on the site’s WordPress system. In previous attacks, OurMine has used weaker linked accounts to post to services such as Twitter, rather than taking over the user’s social media accounts directly.
The attacks underscore the inherent flaws in linked systems: your accounts, or in this case site, is only as resilient as your weakest link. Security experts recommend the use of two-step verification systems to help prevent accounts being compromised. It is unknown whether TechCrunch writer accounts required two-step verification for access to the site’s WordPress backend.
TechCrunch, which is owned by AOL, and in turn by Verizon, did not respond to request for comment.
By Samuel Gibbs