Cyber Incident Victim: Richland County Sheriff's Department
Date:
Mar 2015
Location:
United States of America
Summary
Pro-ISIS hackers affiliated with Team System DZ, originating from Morocco, compromised multiple government websites in Richland County, Wisconsin, including the Sheriff's Department, municipal services, and public facilities. The attackers defaced the sites with messages expressing support for ISIS, condemning Israel and the United States, and promoting jihad. Other impacted entities included the county's ambulance service, recycling center, fitness center, and land conservation department. The hackers replaced legitimate web content with their propaganda across all targeted platforms. Services were subsequently restored following the breach. This incident aligns with a broader pattern of pro-ISIS cyber activities targeting U.S. government entities during this period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 21, 2015, pro-ISIS hackers operating under the name Team System DZ, identified as Moroccan, breached multiple websites affiliated with Richland County, Wisconsin. The attackers compromised the Richland County Sheriff’s Department website alongside six other county-operated sites: the City of Richland Center Municipality, Parks Commission, Ambulance Service, Richland County Fair & Recycling, Land Conservation Department, and Richland County Fitness Center. Hackers replaced legitimate content with a defacement page displaying the message "Hacked by Team System Dz! I am a Muslim & I love jihad, I love ISIS | Fuck Israel & USA." This action demonstrated explicit support for ISIS and hostility toward the United States and Israel. The defacement mirrored tactics used in prior ISIS-aligned cyber operations, including recent leaks targeting U.S. military personnel and the hijacking of Newsweek’s Twitter account in February 2015. No data theft or additional disruptive actions beyond the defacement were reported in the incident.
The attack occurred within a broader pattern of pro-ISIS cyber activity targeting U.S. government entities, including the January 2015 breach of the Isle of Wight, Virginia’s website. Richland County, with a population of 18,021 as of 2010, faced temporary disruption to its public-facing online services, though critical operational systems appeared unaffected. Restoration efforts were completed prior to the article’s publication date, with all compromised sites returning to normal functionality. No claims of data exfiltration, financial motives, or follow-on attacks were documented. The incident highlighted vulnerabilities in the county’s web infrastructure but did not disclose specific technical vectors or duration of downtime. Authorities did not publicly attribute the attack beyond the hackers’ self-identification, and no subsequent arrests or indictments were mentioned in the source material.