Cyber Incident Victim: Azerbaijani State Customs Committee
Date:
Jul 2015
Location:
Azerbaijan
Summary
Armenian hackers affiliated with the Monte Melkonian Cyber Army breached the Azerbaijani State Customs Committee's systems, exfiltrating highly sensitive personal data including names, passport copies, ID cards, PIN codes, contact details, and birthdates of 5,650 citizens. The attackers additionally leaked resumes from an Azerbaijani engineering firm and defaced 45 websites, embedding anti-Azerbaijani messages and a proof-of-concept video demonstrating unauthorized access to the customs portal using stolen credentials. The group claimed the operation was retaliatory, citing prior cyberattacks by Azerbaijani actors as motivation, and emphasized their readiness to escalate hostilities in the ongoing cyber conflict linked to the Nagorno-Karabakh dispute.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 2, 2015, Armenian hackers operating under the name Monte Melkonian Cyber Army infiltrated the official website of the Azerbaijani State Customs Committee. The attackers exfiltrated highly sensitive personal data belonging to 5,650 Azerbaijani citizens, including full names, paternal names, surnames, dates of birth, passport copies, national ID cards, PIN codes, telephone numbers, and email addresses. A secondary batch of stolen data contained resumes from encotec.az, an Azerbaijani engineering firm. The hackers simultaneously defaced 45 Azerbaijani websites, embedding anti-Azerbaijani messages and a YouTube video as part of their campaign. They publicly released samples of the stolen data on Pastebin, including a detailed list of compromised websites and instructions demonstrating how to use leaked passport IDs and PIN codes to access individuals' accounts on the customs domain.
The group explicitly stated their attack was retaliation for prior cyber operations by Azerbaijani hackers, warning through communications with HackRead that future responses would be "more painful." Historical context indicates both nations engaged in reciprocal cyber attacks, including Azerbaijani hackers compromising Armenian presidential and ministry websites in June 2014. The stolen data’s authenticity was verified by journalists, who confirmed its legitimacy but withheld publication to protect victims’ privacy. No information was disclosed regarding detection methods, containment measures, or official responses from Azerbaijani authorities. The incident occurred against the backdrop of unresolved military and diplomatic tensions stemming from the Nagorno-Karabakh conflict, which has historically fueled cyber hostilities between the two nations.