Vigilance
Attribution profile
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Vigilance is the alias used by a hacker who operates from the United States of America and came to public attention in June 2017 after breaching Minnesota government databases. The actor identified himself as Vigilance when contacting Motherboard and provided a sample of stolen data to substantiate the claim. The intrusion targeted the admin.state.mn.us server, which connects to other state domains such as mn.state.us and mn.gov, and resulted in the exfiltration of approximately 1,400 email addresses paired with hashed passwords. The stolen material included contact information for external contractors, users of a state‑maintained scientific forum, and a small number of IT administrator accounts associated with Minnesota government employees.
The hacker described the action as a protest against a controversial police shooting verdict involving Philando Castile, stating that the breach was intended to seek justice for what he perceived as a failure of the legal system. All passwords obtained were protected with the descrypt hashing algorithm, and the actor reported being unable to crack them despite attempting to do so. No malware families, specific initial access vectors, or custom tooling were mentioned in the reporting; the operation relied on direct database access and data exfiltration. The actor publicly leaked portions of the stolen data, which contained verified government email addresses and private citizen telephone numbers, to highlight the breach and underscore the protest motive.
No public attribution links Vigilance to a state sponsor, criminal consortium, or any broader affiliation; the actor remains an individual hacktivist acting alone. The Minnesota IT Services confirmed the incident, launched an investigation, and coordinated with law enforcement to assess potential criminal activity. This event stands as the sole publicly documented operation associated with the Vigilance alias, illustrating a hacktivist‑driven targeting of government systems motivated by social justice concerns rather than financial gain or espionage.
Incidents
Attributed incidents are available to members.
1 incident