Burger King, Jeep Tweet-Hacks Show It's Time For A Social Kill Switch
The Twitter takedown of Burger King (NYSE:BKW) on Monday (Feb. 18), followed by an almost identical attack on Jeep's Twitter account the next day, underlines a basic problem with social media: It's almost never under a retailer's control. It's not just that interacting online with customers is inherently unpredictable. The key social media sites themselves—Twitter, Facebook (NASDAQ:FB) and others—are always under someone else's control, and a chain is just another user.
That means when a retailer's social media presence is under attack, the difference between being down for more than an hour (like Burger King) or just 10 minutes (like Jeep) can be a matter of setting up the equivalent of a kill switch—and that's going to take some work.
It's still not clear exactly how either site was taken over by anonymous hackers—whether the attackers got in through an actual breach in Twitter or just managed to acquire passwords to the Burger King and Jeep accounts. (That may become clearer over the next few weeks because, if it is an actual Twitter breach, we can expect to see a stream of copycat attacks.)
In Burger King's case, after its Twitter page was replaced with one featuring McDonald's (NYSE:MCD) branding and the account tweeted that the chain had been sold to McDonald's, it took more than an hour for Burger King to notice, contact Twitter and disable the account, before resetting passwords and restoring the site.
The following day, Jeep's Twitter page was replaced with Cadillac branding (including a Cadillac painted with a McDonald's logo, according to some reports) and tweets claiming Jeep had been sold to General Motors' (NYSE:GM) Cadillac division. But the Jeep takeover only lasted 10 minutes before it was cut off.
How was Jeep able to cut off the attackers so fast? "According to the folks at Twitter, they were able to assist us more quickly because they were better prepared as a result of the previous day's attack on Burger King's account," said Jeep Spokesperson Ed Garsten. "It also was vital that our social media agency was quick to detect the issue and respond to it immediately."
In other words, Jeep got lucky because it was second in line. That will also help any retailers hit by a similar Twitter attack in the next few days.
Then things will go back to normal, Twitter will no longer be on high alert and the usual impossible-to-contact-anyone situation will return—until the next round.
Part of the problem is with how retailers think about social media.Part of the problem is with how retailers and other big organizations think about social media. It's outside their hands, and they're accustomed to either having control of tech-related functions or not having to worry about them.
But that mindset won't work here. Chains have too much exposure when they put their names and reputations on a social media site. It's easy to assume that security isn't a big deal for Twitter and Facebook accounts. But those accounts should be treated with security as tight as internal accounts; namely, with passwords that are changed whenever an employee leaves the social media team and close monitoring to watch for anomalies.
(Something as simple as routine password changes would have saved the 257-store British entertainment chain HMV from an internal Twitter hijacking in December, when a former member of the retailer's social media team tweeted layoffs in real time while the chain's marketing director scrambled to shut down the Twitter feed.)
That's preventive medicine. But chains also need a kill switch—the ability to shut things down quickly, regardless of whether the security failure is within the chain or on Twitter's or Facebook's side. That means acquiring an actual human contact at each social media company (they're in short supply) and making sure there's a process to disable the account, fast.
That may not be easy. Social media companies are really set up to handle customer-service problems with automated forms, so Walmart (NYSE:WMT) has to get in line behind every other Twitter tweeter whose account has been compromised. Chains are in the unfamiliar position of not being huge customers of Twitter and Facebook, so they don't automatically qualify for special treatment.
That means it's time to start talking to the big social media companies you deal with. If your social media is handled by an outside agency, it might be able to make progress. But sometimes a C-level title makes an impression that makes a difference.
And now is a good time to start that process. Twitter is likely to be very receptive. Facebook knows it's next in line. With luck and their cooperation, you could end up with a relatively clean kill-switch process that minimizes the time between a social media takeover by hackers and recapturing your page. Without that, you may just have to watch your social media accounts and have a "we've been hacked" form constantly queued up and ready to send.
What's certain is that the Burger King scenario will happen again, and someone is going to be first in line. You really don't want it to be you.