Cyber Incident Victim: State of Michigan Portal
Date:
Jan 2016
Location:
United States of America
Summary
The State of Michigan experienced a distributed denial-of-service attack targeting its official website, causing temporary slowdowns and a brief outage. State technology officials collaborated with law enforcement and private partners to mitigate the disruption, successfully restoring services without subsequent incidents. While other local entities faced similar cyber disruptions around the same period, authorities did not confirm any connection between these events.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 16, 2016, the State of Michigan experienced a Distributed Denial of Service (DDoS) attack targeting its official Michigan.gov website. The attack occurred on a Saturday, causing degraded performance including slower loading times followed by a brief period of complete website unavailability. Caleb Buhs, Public Information Officer for the Department of Technology, Management and Budget (DTMB), confirmed the cyber incident publicly one week later on January 23. State cybersecurity teams, collaborating with private sector partners, successfully mitigated the attack within a short timeframe, restoring normal website operations. No additional attacks occurred in the immediate aftermath of the January 16 incident. The state maintained continuous threat monitoring through established partnerships with the Michigan State Police and FBI, specifically tracking online conversations containing potential threats against state networks.
This incident occurred amid heightened cyber activity related to Flint's water crisis. On January 20, 2016, hacktivist group Anonymous released a video threatening cyber actions against entities connected to the crisis. The following day, January 21, Hurley Medical Center in Flint confirmed it had suffered a separate "cyber attack." Flint's city website subsequently displayed DDoS protection screens on January 22 before redirecting visitors, though city officials declined to confirm whether this constituted an attack. State authorities did not establish any confirmed connection between the January 16 Michigan.gov attack, the January 21 hospital incident, or Anonymous' threats. Technical details regarding attack vectors, traffic volumes, or attacker origins were not disclosed by state officials beyond the confirmation of a DDoS methodology impacting website availability.