Cyber Incident Victim: New York City Comptroller
Date:
Jul 2015
Location:
United States of America
Summary
The New York City Comptroller's official website experienced a partial defacement by a pro-Palestinian hacker using the alias AlfabetoVirtual, who modified the site's header and description to display a political message advocating "#FreePalestine – #FreeGaza." The attacker, suspected to be a Spanish speaker potentially linked to Argentinian hacking groups, compromised the high-profile government site responsible for fiscal oversight and auditing. This incident followed another recent breach of a U.S. government subdomain by pro-ISIS actors, highlighting consecutive security failures affecting federal digital assets. The compromised site remained altered at the time of initial reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 10, 2015, the official website of New York City Comptroller Scott M. Stringer (comptroller.nyc.gov) experienced a security breach perpetrated by a hacker using the alias AlfabetoVirtual. The attacker successfully bypassed the site's security measures but executed only a partial defacement rather than a complete takeover. The compromise involved altering the website's header to display the message "Hacked by AlfabetoVirtual Hackeado por AlfabetoVirtual #FreePalestine – #FreeGaza" and changing the site's meta description from its official designation to "Hacked By AlfabetoVirtual." Forensic analysis of the defacement message indicated the hacker was likely Spanish-speaking, with open-source intelligence suggesting possible Argentinian connections through the attacker's Twitter account activity, which included retweets in Spanish and associations with members of Team Ha¢king Argentinø. The hacker publicly documented the intrusion through Zone-H (mirror ID 24576881), preserving evidence of the unauthorized modifications.
The New York City Comptroller's Office serves as the municipal government's chief fiscal and auditing authority, making this breach a significant compromise of a high-profile government digital asset. At the time of public reporting, the website remained in its compromised state with no immediate confirmation of restoration efforts. This incident marked the second major breach of a U.S. government-affiliated website within a 48-hour period, following a separate defacement by pro-ISIS actors targeting a subdomain of the U.S. Department of Energy's Argonne National Laboratory. While the attack did not result in full website control or apparent data exfiltration, the unauthorized political messaging introduced reputational risks and operational disruptions to a critical municipal oversight institution. The defacement's persistence at publication time indicated delayed detection or containment protocols for the compromised web infrastructure.