Cyber Incident Victim: Saudi Ministry of Foreign Affairs
Date:
May 2015
Location:
Saudi Arabia
Summary
A cyberattack attributed to the Yemen Cyber Army compromised the Saudi Ministry of Foreign Affairs, motivated by opposition to Saudi military actions in Yemen. The attackers breached servers, defaced the website, and exfiltrated sensitive data including plain-text login credentials, embassy communications, VSAT details, and diplomatic correspondence. They claimed control over thousands of systems and access to diplomats' personal information globally, releasing a subset of stolen materials while threatening further leaks. The incident highlighted critical security failures, particularly the storage of passwords in unencrypted form on government systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On May 22, 2015, the Yemen Cyber Army (YCA) claimed responsibility for breaching the Saudi Ministry of Foreign Affairs (MOFA) website and internal networks. The group stated the attack was a direct response to Saudi Arabia's military actions in Yemen. Hackers defaced the official MOFA website (services.mofa.gov.sa) and published a mirror of the defacement on Zone-H as proof. According to their communications with HackRead, YCA asserted they obtained "full control" over more than 3,000 computers and servers within the MOFA network, compromising thousands of user accounts across Saudi diplomatic missions worldwide. The attackers exfiltrated confidential data including plain-text login credentials for 162 email accounts, embassy VSAT communications, telex messages, and mailbox samples.
The leaked data included databases containing usernames, phone numbers, and thousands of email addresses belonging to Saudi officials. YCA published three sample files demonstrating access to embassy communications and shared folder links protected with passwords that enabled further data retrieval. Hackers announced their intent to gradually release additional stolen materials, including secret emails and documents from MOFA’s automation systems. A defacement message on the hacked website accused Saudi Arabia of supporting ISIS, declaring "You are ISIS and ISIS is you." The incident revealed critical security failures, notably the storage of passwords in plain text on government systems. No official response or containment measures from Saudi authorities were documented in the source material at the time of reporting.