Companion article · Special Report · By Felix McKenzie
Information current to October 31, 2026. Ahmad Umar Agha was sentenced October 29, 2026. Firas Dardar remains a fugitive, and everything about his alleged role stays alleged until a court says otherwise.
At 1:07 p.m. Eastern Time on April 23, 2013, a message appeared on the official Twitter account of the Associated Press.
It claimed that two explosions had occurred at the White House and that President Barack Obama had been injured.
The report was false.
There had been no explosions. The president was unharmed. The Associated Press had not published a genuine breaking-news report about an attack.
Instead, someone had gained unauthorised control of the news organisation's Twitter account.
The account had approximately two million followers, and its messages were widely monitored by journalists, financial institutions, and market participants.
Within minutes, the false report produced a sharp reaction in American financial markets.
The incident demonstrated how a compromised information source could affect systems far removed from the original intrusion.
The hackers had not needed to enter a stock exchange.
They had entered a trusted news account.
Financial markets respond rapidly to information concerning political stability, national security, and major economic developments.
A genuine attack on the White House involving the president would have represented an extraordinary national emergency.
The false Associated Press message therefore contained information that, if true, could reasonably have influenced investment decisions.
At approximately 1:08 p.m., American stock indexes began falling.
The Dow Jones Industrial Average dropped roughly 143 points, from approximately 14,697 to 14,554.
The Standard & Poor's 500 index fell approximately 0.93 percent within three minutes.
Reuters estimated that the temporary decline represented approximately $136.5 billion in the market value of companies included in the S&P 500.
This figure requires an important distinction.
It did not mean that $136.5 billion in cash had disappeared or that investors collectively realised losses of that amount.
It represented a temporary reduction in the calculated market capitalisation of publicly traded companies.
As the false report was identified and corrected, stock prices recovered.
Within minutes, the major indexes had returned close to their previous levels.
The immediate disruption was brief.
Its implications were considerably more enduring.
The Associated Press responded rapidly after discovering the unauthorised message.
Its journalists and corporate communications staff used other channels to warn that the Twitter account had been compromised.
The organisation suspended the affected account and worked with Twitter to investigate the intrusion.
White House Press Secretary Jay Carney also confirmed that President Obama was unharmed.
The corrections helped restore confidence in the information reaching financial markets.
By approximately 1:18 p.m., the Dow had recovered from the sudden decline.
The sequence illustrated the importance of trusted corrections during an information emergency.
But it also exposed a fundamental difficulty.
The original false message could travel through automated systems and human networks before its authenticity had been independently established.
The correction followed quickly.
The market reaction had already occurred.
Responsibility for the intrusion was claimed by a group calling itself the Syrian Electronic Army.
The organisation supported the government of Syrian President Bashar al-Assad during the Syrian civil war.
It became known for cyberattacks against news organisations, political opponents, and institutions regarded as hostile to the Syrian government.
Its activities included website defacement, unauthorised access to communications accounts, and the publication of political messages through compromised platforms.
American investigators subsequently linked members of the organisation to a broader hacking conspiracy.
In March 2016, the United States Department of Justice announced criminal charges against three Syrian nationals associated with the group.
The defendants included Ahmad Umar Agha, known online as The Pro, and Firas Dardar, known as The Shadow.
A third defendant, Peter Romar, was accused in a related extortion conspiracy.
Prosecutors alleged that members of the organisation targeted media companies, government agencies, international organisations, and private businesses.
The Associated Press intrusion was one incident within that wider campaign.
The April 2013 attack did not involve stealing money directly from a bank or altering records inside a stock exchange.
Instead, the attackers exploited the credibility attached to an established news organisation.
The Associated Press was a trusted supplier of breaking news to institutions around the world.
A message appearing on its official account could be mistaken for information that had passed through the organisation's normal editorial procedures.
That assumption was central to the attack's effectiveness.
The incident also occurred during a period of heightened security concern in the United States.
The Boston Marathon bombing had taken place only eight days earlier, followed by a major manhunt.
A false report of explosions at the White House therefore appeared in an already sensitive information environment.
Financial analysts later examined how news feeds, social-media monitoring, automated trading systems, and human decision-making contributed to the market's response.
The precise contribution of each mechanism was not conclusively established by the public reporting.
It would be inaccurate to attribute the entire decline exclusively to trading algorithms.
What was established was the relationship between the false report, the immediate sell-off, and the subsequent recovery.
The Syrian Electronic Army's operations extended beyond political messaging.
American prosecutors described a campaign involving computer intrusions, stolen credentials, interference with websites, and attempts to intimidate organisations considered hostile to the Assad government.
Some members also became involved in financially motivated extortion.
In September 2016, Peter Romar pleaded guilty to offences involving unlawful computer access and receiving extortion proceeds.
The criminal proceedings against Agha and Dardar continued separately.
In May 2018, a federal grand jury returned an indictment alleging their participation in a hacking conspiracy.
The indictment identified numerous targets, including the Associated Press, Reuters, National Public Radio, major American newspapers, and government institutions.
The investigation demonstrated that the April 2013 incident was not simply an isolated act of online vandalism.
It formed part of a sustained campaign targeting institutions responsible for producing, distributing, and protecting information.
On October 29, 2026, the United States Department of Justice announced that Ahmad Umar Agha had been sentenced to three years and six months in federal prison.
According to prosecutors, Agha had played a central role in a hacking conspiracy organised by individuals connected to the former Assad government, including senior intelligence officials.
The department attributed approximately 47 successful intrusions against Western media organisations, businesses, nongovernmental organisations, and government-related targets to his activities.
Its announcement specifically identified the April 23, 2013 Associated Press intrusion.
Prosecutors stated that Agha had used the compromised account to publish the false report about explosions at the White House.
They also reported that he later described the resulting stock-market decline as an intended outcome of the operation.
This was a significant development in a case that had remained unresolved for more than thirteen years.
Unlike the initial 2013 reports, which relied partly on claims of responsibility, the 2026 announcement followed federal criminal proceedings.
Firas Dardar remained a fugitive according to the Justice Department's October 29 statement.
The status of individual defendants must therefore be distinguished rather than treating every member of the Syrian Electronic Army as having received the same legal outcome.
The Justice Department's 2026 account placed the Associated Press attack within a wider operation that served the former Syrian government's interests.
Prosecutors described efforts to undermine independent reporting, spread propaganda, intimidate opponents, and collect intelligence.
Other incidents included the compromise of a service provider associated with the United States Marine Corps recruitment website.
Visitors were redirected to a political message encouraging American military personnel to refuse their orders.
Investigators also documented attempts to gain access to White House social-media accounts.
These operations did not all have the same objectives.
Some sought to influence public opinion. Others attempted to interfere with communications or obtain information.
The Associated Press incident was distinctive because the resulting market disruption could be measured almost immediately.
It demonstrated that an information operation directed at a media organisation could have consequences in financial infrastructure without directly penetrating that infrastructure.
The April 2013 market disruption lasted only minutes.
Nevertheless, the incident exposed a dependency that remains relevant to modern information systems.
Financial markets, government agencies, news organisations, and the public all rely on information arriving from sources they consider trustworthy.
The systems distributing that information may operate faster than the processes required to verify it.
When a trusted source is compromised, its credibility can temporarily become an instrument of deception.
In this case, the Associated Press identified the intrusion, the White House corrected the false claim, and financial markets recovered.
The correction mechanisms worked.
But they worked after the initial disruption.
The subsequent criminal investigation established the wider context of the attack, while the October 2026 sentencing brought a major defendant's case to a conclusion.
The episode illustrates a form of institutional vulnerability that does not depend on defeating every technical safeguard.
A compromised account can carry a false message into systems that were designed to respond to genuine information.
On April 23, 2013, no explosion occurred at the White House.
The president was not injured.
Yet for several minutes, financial markets responded to an emergency that existed only as text on a screen.
The information was false. The consequences were real.