Case Study: The Hacking of Mat Honan
Where you are: Unit I — The Security Mindset · Lesson 1.3 · This lesson follows Chapter 2 of Dr. Al-Doori's Cyber Security Essentials (the Honan case).
What you'll be able to do
By the end of this lesson you will be able to trace how a chain of linked accounts was taken over and identify which defenses would have broken the chain.
- Follow the attack step by step, from public information to a wiped laptop.
- Explain why account recovery and customer support can be an attacker's way in.
- Choose the changes that would have stopped the chain or limited the damage.
The Attack That Needed No Hacking Skills
In August 2012, technology journalist Mat Honan lost most of his digital life to a chain of account takeovers. Attackers took over his Google account and deleted it. They used his Twitter account to post offensive messages to his followers. And they used his Apple account to remotely erase his iPhone, iPad and MacBook, destroying photos of his daughter that he had not backed up anywhere else.
The striking part, and the reason Dr. Al-Doori chose this story, is how little technical skill it took. Nobody cracked a password or broke any encryption. The attackers used a web browser, a telephone and personal details that were already available. Honan himself described it as a con job: they talked their way past the companies' customer-support checks. This is social engineering: manipulating people into doing something that helps the attacker, here by pretending to be the account owner.
Following the Chain
Each step gave the attackers exactly what they needed for the next one.
- Gather public information. The attackers started by collecting personal details about Honan that were publicly available.
- Amazon, first call. Posing as Honan, they called Amazon and added a fake card number to his account.
- Amazon, second call. They called back, said they were locked out, and used that fake card number to "prove" who they were. Amazon let them into the account. There they could see the last four digits of his real card.
- Apple. At the time, Apple's phone support accepted a name, email address, billing address and those last four card digits as proof of identity. That was enough to reset his Apple ID, which gave them his Apple email address and the power to wipe his devices.
- Google. His Gmail account sent its password-reset link to that Apple email address. With Apple in hand, Google fell next.
- Twitter. With his email under their control, they reset his Twitter account, which was the prize all along.
Notice the pattern. No single company was "hacked" in a technical sense. Each one trusted information that another company had leaked or that anyone could find. Honan's accounts were also linked, or daisy-chained: one account recovered another, so access to one became access to all. Dr. Al-Doori points out that some of these weaknesses were outside Honan's control, but the linking was one he could have fixed himself.
Confidentiality, Integrity and Availability, All at Once
This one attack broke all three properties of the CIA triad from Lesson 1.2:
- Confidentiality: the attackers got into his private accounts and messages.
- Integrity: they posted messages pretending to be him and deleted his data.
- Availability: they locked him out and wiped his devices, so some of his data was gone for good.
Real-World Example
Why Honan? It is tempting to assume he was targeted because he was a well-known security writer. According to Honan, the attackers wanted something much smaller: his rare three-letter Twitter username, @mat. Everything else, the wiped devices and the lost photos, was collateral damage done to keep that prize.
The lesson for you is that you can be targeted for something you own, not only for who you are. A short username, a gaming account, a cryptocurrency wallet or a well-followed social profile can all make an ordinary person worth an attacker's afternoon.
The case also changed things. After the story was published, Apple and Amazon changed the support policies the attackers had abused. Account recovery, meaning the way you get back into an account when you are locked out, is now widely recognised as one of the most important doors to protect.
From the Book to 2026
What the book teaches. Dr. Al-Doori uses the case to show risk at work. A second sign-in step (a password plus a one-time code sent to his phone) would have reduced the vulnerability. Backing up his daughter's photos would have reduced the impact. The book treats his threat as high because he was a public figure who wrote about security. (Honan's own byline spells his first name "Mat".)
Why it made sense. Two-step sign-in and backups were exactly the right lessons, and Honan drew the same two himself. He wrote that he should have backed up his MacBook and should not have linked his accounts together. He also said that two-step verification on Google might have prevented much of what followed.
What has changed. Security guidance has evolved since the original text in three ways. First, motive: Honan's account shows the attackers were after a username, so ordinary people with something valuable are targets too. Second, second steps differ in strength. Codes sent by text message are now considered the weakest kind, and current guidance from CISA, the US cyber defense agency, prefers authenticator apps and, best of all, phishing-resistant methods such as passkeys. Third, account recovery itself is now treated as an attack surface. A strong password on the front door does not help if the back door opens for anyone who sounds convincing.
What to do now. Protect your main email first, because it resets everything else. Give it the strongest second step it offers. Check where each important account sends its reset links, and avoid chains where one account can recover all the others. Keep backups of anything irreplaceable. Units IV and V show you how to do each of these.
Watch: How the Hackers Did it — Defeating the Hackers
In this short clip, Honan describes the attack in his own words, step by step. Hearing it from the victim makes the chain very concrete.
As you watch, notice:
- Honan's point that the attackers did not break his password or any encryption. He calls social engineering "a fancy term for a con job".
- The two-call trick at Amazon: add a card on the first call, then use that same card to get in on the second.
- That Apple accepted the last four digits of a card as identity verification at the time, and that the attackers deleted his Google account so he could not use it to regain control of Twitter.
The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
You own a rare, short username on a popular gaming platform, and strangers have offered to buy it. The gaming account sends its reset links to your personal email. That email is protected only by a password, and its own recovery goes to a phone number you rarely check. You have 20 minutes tonight. Which two changes do you make first?
Knowledge Check
Honan's devices were wiped remotely, and some photos were lost for good. Which single habit would have most limited that damage?
Looking back at the whole chain, what made Honan's case spread from one account to all of them?
Answers explained
- Question 1 — b. Once the devices were wiped, only a copy kept somewhere else could have saved the photos, and Honan said himself that he should have backed up. Option a would not have helped: the attackers never needed his Apple password, because phone support reset it for them. Option c makes no difference to an attack carried out by phone. Option d misses the point: the attackers wanted his username, whether or not he posted.
- Question 2 — c. The chain spread because the accounts were linked: Apple's email recovered Google, and Google's email led to Twitter. Option a is wrong because no malware was involved. Option b does not describe this case, which did not depend on password reuse. Option d is wrong because the attackers phoned support desks rather than sending him a phishing link.
On "What Would You Do?": start with the account that unlocks the others, your personal email. Turn on the strongest second sign-in step it offers, then update its recovery options to ones you control and check. Together these break the chain at its root. Turning on a second step for the gaming account itself, if offered, is next.
Key Takeaways
- The Honan attack used a phone, a browser and public information, not technical hacking: it was social engineering of support desks.
- Linked accounts turn one weakness into total loss. Know which account resets which.
- Account recovery is an attack surface. Protect your email and its recovery options first.
- You can be targeted for what you own, such as a short username. Backups limit the damage when prevention fails.
Sources
- Mat Honan, repost of "How Apple and Amazon Security Flaws Led to My Epic Hacking" (Wired, 6 August 2012) — seclists.org
- PBS NewsHour — Tips From Mat Honan After the Hack That Brought Down His Cloud (2012)
- SecurityWeek — Amazon and Apple Change Policies After Journalist Attacked (2012)
- TidBITS — How Apple and Amazon Security Flaws Led to Mat Honan Being Hacked (2012)
- CISA — Implementing Phishing-Resistant MFA (fact sheet)
- Dr. Tahseen Al-Doori — Cyber Security Essentials (Second Edition, 2026), Chapter 2