Cyber Incident Victim: Metropolitan Police Service
Date:
Nov 2016
Location:
United Kingdom
Summary
Hackers associated with the Anonymous collective disrupted a Metropolitan Police news website for eight hours, claiming retaliation for arrests made during an anti-capitalist protest featuring participants in Guy Fawkes masks. The attack, publicly claimed by an individual using the alias "Crash Override," targeted a non-operational section of the site during the annual Million Mask March, which was inspired by themes from the V For Vendetta graphic novel. The hackers explicitly linked the website downtime to the protest arrests in their communications, though the compromised system was isolated from sensitive police infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On November 5, 2016, during the annual Million Mask March in central London, thousands of protesters—many wearing Guy Fawkes masks inspired by the graphic novel *V For Vendetta*—gathered for an anti-capitalist demonstration that culminated in violence. The Metropolitan Police made dozens of arrests during the event. In apparent retaliation for these arrests, hackers claiming affiliation with the collective Anonymous targeted a public-facing news section of the Metropolitan Police’s website at approximately 9:00 PM that evening. A hacker using the alias “Crash Override” publicly claimed responsibility for the attack via Twitter, posting the message “arrests=downtime bitch” as the website became inaccessible. The disruption lasted approximately eight hours, rendering the affected news subsection offline during this period.
The compromised system was isolated from the Metropolitan Police’s sensitive operational infrastructure, limiting the incident’s scope to public news dissemination. No evidence suggested unauthorized access to law enforcement databases or internal networks. The attack coincided with heightened public attention on the protest’s aftermath, temporarily impairing the Met’s ability to share official updates through its primary news portal. The Metropolitan Police did not publicly detail technical countermeasures taken during the incident but confirmed the separation between targeted public systems and critical operational assets. The hacker’s explicit linkage of the attack to protest arrests established a retaliatory motive tied to the day’s enforcement actions.