An Garda Siochana social media accounts hijacked and used to promote cryptocurrency posts

Officers from An Garda Siochana confirmed on October 15, 2026 that multiple official social media profiles had been accessed without authorisation and repurposed to push cryptocurrency promotional posts. The breach was first noticed early on October 15 when accounts used by the state police for traffic and public information began publishing a high volume of posts unrelated to policing.

What happened and how it was noticed

Users and journalists observed that the accounts normally reserved for traffic updates and public safety messages started displaying posts that advertised a cryptocurrency wallet or token. Profile details on at least two prominent accounts were altered, including visible location fields and account names. One of the affected profiles had its username changed to appear as a customer support handle for a wallet service, while another retained its traffic branding but showed location information inconsistent with Ireland.

Social platforms placed warnings on some of the posts after detecting links between the compromised profiles and other accounts flagged for spam or malicious activity. Old posts and videos left on the pages indicated the accounts were genuine Garda channels before the change in content, suggesting the accounts themselves, rather than imitation pages, were the target.

Immediate response and investigation

An Garda Siochana said it had been contacted for comment and that it was investigating the incident. Platform operators removed or restricted access to the altered posts while investigating the apparent breach. Garda spokespeople told reporters they were treating the takeover as a serious security incident and that they would work with the social media companies to restore control and establish the method of intrusion.

The intrusion was detected during usual monitoring by journalists and members of the public, who reported sudden, nonpolicing content appearing on high follower accounts. That community reporting helped bring the issue to platforms and to the attention of Garda sources much faster than automated detection alone.

Why this matters to citizens and victims of scams

Law enforcement social accounts are trusted sources for safety updates and official notices. When those accounts are commandeered to promote scams or financial products it multiplies the danger, because people who follow the accounts for urgent information may accept posts at face value and click on links or follow payment instructions.

Cryptocurrency promotions are a recurrent theme in social account takeovers because they allow immediate, hard to trace transfers. Even short lived posts can funnel victims to fraudulent wallet services or investment sites. The use of Garda-branded channels intensifies the risk that readers will treat the content as legitimate.

Platform and organisational security gaps

Security specialists say account takeovers happen for multiple reasons, including credential theft, weak account recovery procedures, compromised third party applications with linked access, or social engineering of staff. The attack against policing profiles underlines how important it is for public agencies to adopt strong multi factor authentication, strict access control for social media logins, and routine audits of connected apps and administrator lists.

Platforms can reduce harm by flagging unusual changes in account behaviour, placing temporary restrictions on posts pending verification, and offering expedited support channels for verified public bodies. The incident will likely prompt a review of how platform providers verify and protect official accounts that have responsibilities for public safety.

What people should do if they see suspect posts

• Do not follow links, send funds, or provide personal information in response to posts promising cryptocurrency gains or instructions that ask for money.
• Verify urgent or unusual messages by checking an official agency website or contacting the organisation by a published phone number before acting.
• Report suspicious posts to the social platform and, where appropriate, to local Garda stations or to the Garda online reporting channels for fraud and cybercrime.

Broader context

Social media account hijacks aimed at promoting cryptocurrency have hit high profile organisations and individuals in recent years. Those incidents typically have financial motives and follow similar playbooks. This breach adds a public safety dimension because policing accounts play a role in crisis communication and routine safety alerts, raising both security and reputational stakes for the force and for platform operators.

An Garda Siochana and the social platforms involved are continuing to investigate and to restore genuine account control. The outcome of the technical inquiry, including how the access was gained and whether any follower accounts were directly defrauded, will determine whether criminal inquiries follow and whether further preventive measures are required across public sector social accounts.

For now, Garda communications advise the public to treat unexpected financial posts, even if they appear on official pages, as potentially unauthorised and to seek confirmation from official Garda channels before acting on any financial or personal data requests.