Cyber Incident Victim: Mumsnet
Date:
Aug 2015
Location:
United Kingdom
Summary
The parenting website Mumsnet experienced a distributed denial-of-service attack and swatting incident targeting its founder, resulting in temporary service disruption. A group identifying as @DadSecurity claimed responsibility, having previously tweeted threats and images of SWAT teams; this preceded armed police responding to a false emergency report at the founder's residence. The attackers also swatted a forum user who interacted with the group, raising concerns about how personal addresses were obtained despite the site's policy of not collecting such data. Mumsnet speculated that fake login pages may have been used to harvest user credentials for unauthorized access.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 19, 2015, the parenting website Mumsnet experienced a distributed denial of service (DDoS) attack that overwhelmed its servers with excessive access requests, forcing the platform temporarily offline. Concurrently, co-founder Justine Roberts became the target of a 'swatting' attack, where an anonymous individual falsely reported a gunman at her residence, prompting an armed police response team to arrive at her home. A Twitter account using the handle @DadSecurity claimed responsibility for both incidents, posting messages including "RIP Mumsnet" and "Our DDoS attacks are keeping you offline," accompanied by an image of a SWAT team. The same group targeted a Mumsnet user who had interacted with @DadSecurity, subjecting them to a similar swatting incident. Twitter subsequently suspended the @DadSecurity account following these events. Mumsnet confirmed the attacks disrupted service but provided no evidence of compromised user data beyond the DDoS disruption.
Mumsnet stated it does not collect residential addresses, raising unresolved questions about how the attackers located both Roberts and the targeted user. The company emphasized that user passwords remained encrypted but speculated attackers might have created a fraudulent Mumsnet login page to harvest credentials, enabling unauthorized site access. Roberts publicly documented the swatting incident on the platform, confirming the police response occurred but providing no further details about operational restoration timelines or forensic findings. The motivation behind @DadSecurity’s actions remained unclear, with no additional claims or communications from the group following their account suspension. Service interruptions were confined to the DDoS period, with no subsequent reports of prolonged downtime or data breaches directly attributed to the incident.