Cyber Incident Victim: City of Amasya
Date:
Feb 2014
Location:
Turkey
Summary
RedHack compromised the City of Amasya's website, exfiltrating and leaking AKP membership applications as part of a coordinated protest against Turkey's controversial internet legislation. The hacktivist group simultaneously defaced multiple municipal and government sites—including altering gas pricing displays to zero with anti-corruption messages—and publicly disclosed sensitive documents such as school expenditure records, which they alleged revealed financial misconduct like inflated utility bills. These cyber intrusions were explicitly linked to broader demonstrations criticizing the law's restrictions on free speech and transparency.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In February 2014, the Turkish hacktivist group RedHack initiated a series of cyberattacks targeting government-affiliated entities in protest of Turkey’s newly enacted internet censorship law. The group first leaked approximately two dozen phone numbers belonging to police officials described as “murderer police chiefs and superintendents,” framing this action as an initial phase of their campaign. Subsequent attacks included the defacement of the Kars Municipality website (kars.bel.tr), where RedHack posted protest messages condemning the internet restrictions. The Gas Distribution Authority of Sakarya (agdas.org) was similarly compromised, with hackers altering the site to display gas prices as zero and declaring gas “free” due to government corruption. RedHack then breached the City of Amasya’s systems, exfiltrating and leaking membership applications for the ruling Justice and Development Party (AKP). A separate attack on the Turkish Ministry of Education resulted in the public disclosure of school expenditure records and invoices via JustPaste.it, which RedHack claimed revealed “astronomical expenditures” and corruption in water billing. The group announced these actions on Twitter, explicitly linking them to nationwide protests against the internet law.
The attacks occurred amid widespread public demonstrations across Turkey, with critics arguing the law imposed undue restrictions on freedom of speech. The European Union echoed these concerns, with European Commissioner for Enlargement spokesperson Peter Stano urging Turkey to revise the legislation to align with European standards, emphasizing the public’s right to transparency over increased restrictions. RedHack’s breaches exposed sensitive operational and personal data—including internal party documents, financial records, and law enforcement contacts—amplifying public scrutiny of alleged institutional corruption. While the article details the attackers’ methods (defacements, data leaks, and social media announcements), it does not specify remediation efforts by the affected entities. The incident underscored the intersection of digital activism with political dissent, as RedHack leveraged cyber operations to directly support physical protests against government policy.