Hacktivism: When Cyber Attacks Carry a Message

The 30-second explanation

It is protest by computer. Instead of a banner outside a building, the group defaces a website, leaks documents or floods a service with traffic, then announces it.

How it works

1. 1

   1. Cause

   A political or social issue drives action.

2. 2

   2. Target

   An organisation linked to the issue.

3. 3

   3. Action

   Defacement, leak or traffic flood.

4. 4

   4. Announce

   The group publicises the result.

Hacktivist groups pick targets linked to an issue in the news: a government agency, a company, an event. Because the goal is publicity, they favour actions that are easy to see and announce, and they are often loosely organised. Many attacks are simple but disruptive. Defenders respond by protecting public-facing services, having a communications plan, and checking claims carefully, since some are exaggerated or false.

Real-world example

How to spot it

• Public posts naming you

  Mentions of your organisation in protest campaigns.

• Traffic spikes on public sites

  Sudden load on websites in the news.

• Unexpected content changes

  Pages that changed without a release.

• Claims of a leak

  Statements that need to be verified before reacting.

What to do

1. 1Protect public websites with DDoS mitigation, patching and strong admin controls.
2. 2Monitor for mentions of your organisation during relevant events.
3. 3Verify claims before responding publicly, and prepare a communications plan.