Cyber Incident Victim: Uganda Ministry of Finance
Date:
Feb 2016
Location:
Uganda
Summary
Hacktivists associated with Anonymous launched cyber operations targeting multiple African nations as part of a campaign against corruption, initially breaching Rwanda's Broadband Systems Corporation by compromising backend systems and leaking sensitive employee data, internal communications, and hashed credentials. Subsequently, attackers infiltrated Uganda's Ministry of Finance through an individual using the alias Hanom1960—who claimed dual affiliation with LulzSec and Anonymous—exfiltrating personal information and password hashes for 220 government personnel, with further attacks planned against other listed countries under the #OpAfrica initiative.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In early February 2016, hacktivists associated with the Anonymous collective initiated #OpAfrica, a campaign targeting multiple African governments over alleged corruption. The World Hacker Team subgroup first breached Rwanda's Broadband Systems Corporation on approximately February 6, compromising backend systems that hosted email accounts, ticketing platforms, and databases. Attackers exfiltrated sensitive organizational data including employee details, hashed passwords, and internal communications, subsequently leaking this information publicly. This intrusion served as the precursor to operations against Uganda, with hackers explicitly listing both nations among eight primary targets in their initial campaign declaration. The Rwanda breach demonstrated the attackers' capability to penetrate critical infrastructure and extract sensitive government-associated data.
The operation expanded immediately to Uganda's Ministry of Finance through actions attributed to hacker "Hanom1960," who claimed dual affiliation with LulzSec and Anonymous. Attackers successfully accessed and stole personnel records for 220 government employees, compromising names, email addresses, and hashed password credentials. This dataset represented a significant breach of Ugandan governmental digital assets, exposing authentication systems and internal communications infrastructure. The hackers publicly framed these actions as retaliation against systemic corruption affecting citizens across targeted nations. Following the Uganda compromise, the collective announced intentions to continue #OpAfrica by targeting South African government systems next, maintaining their published operational sequence. No official response or containment measures from Ugandan authorities were documented in available reporting regarding the incident's immediate aftermath.