Cyber Threat Actor: Kerala Cyber Hackers

Thethreat actor known as the Kerala Cyber Hackers operates under that alias and has been linked to activities originating from India. Public reporting identifies the group as a hacktivist collective rather than a financially motivated or state‑sponsored entity. No public sources attribute the group to any specific government, intelligence service, or criminal consortium. The actor’s known activity to date consists of a single, publicly reported intrusion that occurred in June 2020. This limited footprint means that any broader assessment of size, structure, or capability would be speculative and is therefore omitted.

The June 2020 operation targeted a government health website, specifically the Delhi State Health Mission portal, which stored COVID‑19 patient information. The sector targeted was public health, and the geographic focus was the National Capital Territory of Delhi in India. The group stated that the intrusion was intended as a protest against what they described as inadequate protection and support for healthcare workers during the pandemic. They also criticized the government for storing sensitive personal data without sufficient security measures. Their stated objective was to demonstrate the vulnerability rather than to profit, spy, or cause lasting disruption. According to the reporting, the attackers accessed the portal in under ten minutes and extracted personal data for roughly eighty thousand patients, including names, ages, addresses and test results. They subsequently posted screenshots of the records to illustrate the breach but asserted that they would not release the information publicly. No mention is made of malware families, exploit kits, or specific tooling used in the intrusion, so those details remain unknown. The incident highlighted existing weaknesses in India’s digital health infrastructure and was referenced alongside other pandemic‑related data‑privacy concerns. Authorities had not issued an official response to the allegations at the time of the reports, leaving the actor’s attribution and any potential follow‑up activity undocumented.