Cyber Incident Victim: Bahrain International Airport
Date:
Feb 2023
Location:
Bahrain
Summary
A hacking group identifying as Al-Toufan disrupted Bahrain’s international airport and state-run news agency websites, causing temporary outages including a half-hour airport site takedown, displaying 504 Gateway Timeout errors with messages supporting anti-government protests. The group concurrently defaced articles on a pro-government newspaper’s website, which remained offline during the incident. These coordinated cyberattacks were claimed as commemoration of historical protests against Bahrain’s monarchy and aligned with prior disruptive actions during recent elections, reflecting ongoing tensions between authorities and opposition factions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 14, 2023, Bahrain’s international airport website experienced a targeted cyberattack that rendered it inaccessible for at least 30 minutes during midday. The same attack disrupted the Bahrain News Agency (BNA) website, causing sporadic unavailability throughout the day. A hacktivist group identifying itself as Al-Toufan ("The Flood" in Arabic) claimed responsibility for these incidents, publicly posting images of 504 Gateway Timeout errors affecting both sites. The group stated the attacks commemorated the 12-year anniversary of Bahrain’s 2011 Arab Spring uprising, framing them as acts of solidarity with "oppressed people." Earlier that day, the same hackers compromised the website of Akhbar Al Khaleej, a pro-government newspaper, altering published articles before taking the site offline. The newspaper’s platform remained inaccessible as of February 14. Al-Toufan had previously conducted cyber operations against Bahraini government websites during November 2022 elections, which were boycotted by banned opposition groups. No technical details regarding attack vectors, data compromises, or infrastructure damage were disclosed in available reporting.
The incidents caused temporary disruptions to public-facing digital services but did not affect physical airport operations. Authorities did not issue immediate statements regarding the attacks or recovery measures. The targeting aligned with historical unrest on February 14, the date marking the 2011 protests by Bahrain’s Shiite majority against the Sunni-led government, which was suppressed with regional military support. Past governmental responses to dissent included imprisoning activists, citizenship revocations, and media suppression. While the 2023 cyberattacks demonstrated continued digital activism tied to political grievances, their operational impact appeared limited to superficial website defacements and temporary downtime. The Bahrain News Agency and Akhbar Al Khaleej represented strategic targets due to their roles in state-aligned information dissemination.