Bogotá investigates potential health agency hack over European airport bomb hoax email
Officials in the Colombian capital Bogotá announced Thursday they were investigating whether a city health agency’s email account was compromised or spoofed after it was identified in a bomb hoax email sent to a European airport.
The email was one of a wave of hoax threats that has disrupted dozens of flights since Monday, forcing passenger craft to be rerouted and searched for explosive devices. To date, no such devices have been found.
According to a version of the Bogotá hoax email seen by Recorded Future News, it was sent to recipients at Rome’s Fiumicino airport and appeared to come from the domain of Subred Sur Occidente, a public hospital network in southwest Bogotá.
The email falsely claimed explosives were aboard flights to Rome operated by Finnair and Aer Lingus from Helsinki and Dublin. The Finnair flight was ultimately escorted into Rome by Italian air force jets, while the Aer Lingus flight was diverted to a French military base.
Although many of the messages have been signed by a Russian misogynistic movement, banned in Russia itself, experts are wary of making a formal attribution based exclusively on the perpetrators’ message.
In a statement Thursday, shared on the Subred Sur Occidente website, Bogotá mayor’s office said it had received an international alert about the possible use of a city health agency email address related to terrorist threats.
The office said it had ordered an investigation into the incident. It cited recent suspected cyberattacks against public agencies which it said meant it could not rule out the involvement of international hackers or that the agency’s email accounts had been compromised.
However it remains unclear whether the email account was actually used to send the hoax or whether the sender address was spoofed. It is not clear why such an address would be spoofed, and no evidence has emerged implicating the health agency’s staff.
Similar threats were on Friday sent to several Irish media organizations, with those messages reportedly claiming affiliation with the same group behind the airline hoaxes.
In an afternoon statement shared on social media, the Irish government said the “threats made this morning against media organisations here are very serious.”
The statement continued: “It is not known yet who is responsible for these threats, whether it is individuals or a centralised or coordinated effort. However, these threats come on the heels of the ongoing disruption to aviation around Europe caused by similar threats, and it seems likely that this is a coordinated campaign of disruption.”
A spokesperson for the Taoiseach, Ireland’s head of government, did not immediately respond to questions about whether the government’s statement that a co-ordinated campaign “seems likely” reflected an intelligence assessment.
