Twitter’s been hacked again, and this time multiple accounts, including those of major brands and institutions like Duke University, Nike Spain, BBC North America, Reuters Japan, Forbes Magazine, Amnesty International and Western Australia’s power utility, have all fallen to the exploit, reports Gizmodo.

The hacked accounts have tweeted in Turkish with the date 16th April, a date when a referendum will be held in the country to give the president more power. According to the report, the tweets include the words like Nazi Germany and Nazi Holland. The tweets also describe the hacks as a ‘little Ottoman slap’, and end with ‘what did I write? Learn Turkish.’

In a statement, Twitter said that “We are aware of an issue affecting a number of account holders this morning. Our teams are working at pace and taking direct action on this issue. We quickly located the source which was limited to a third party app. We removed its permissions immediately.”

The third party app mentioned is TwitterCounter, an analytics service for Twitter. TwitterCounter has admitted to the hack, and said that it has started an investigation into the matter. It also mentions that it has now blocked all ability to post tweets and changed its Twitter app key and that any further activity would mean it’s not the only one hacked. However, it’s worth noting that the platform was previously targeted in a November 2016 attack causing well-known accounts to spread spam.

Past hacks: In December last year, NDTV journalists Barkha Dutt and Ravish Kumar’s Twitter accounts were hacked, with data such as email passwords posted by the hacker group ‘Legion’ through their Twitter account. The hack was similar to both Rahul Gandhi’s and other Congress members Twitter account hacks or Vijay Mallya’s account hack the week before. However, these groups were carried out by an India-centric group called Legion, rather than by Turkish nationalists.

As we have mentioned before, often accounts get compromised because of access permissions given to other applications, which use Twitter authentication and seek permission to post details. You can remove applications’ permission to access your account here.