Cyber Incident Victim: Internet Corporation for Assigned Names and Numbers
Date:
Aug 2015
Location:
United States of America
Summary
An unauthorized party obtained usernames (email addresses) and encrypted password hashes from user profiles on the organization's public website, though no evidence indicated compromise of profile content, internal systems, or financial data. The breach likely originated through unauthorized access to an external service provider rather than direct infiltration of ICANN's infrastructure. While the hashed passwords were not easily reversible, the organization mandated password resets as a precautionary measure and advised users to employ unique credentials across services. The incident coincided with a separate breach at domain registrar Hover, though no confirmed link between the two events was established at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early August 2015, ICANN disclosed a security breach involving unauthorized access to user profile data from its public website. The organization confirmed that during the prior week, an attacker obtained usernames (which were email addresses) and hashed passwords for accounts created on ICANN.org. These profiles contained user-configured preferences, publicly visible biographical information, stated interests, and newsletter subscription selections. ICANN's investigation found no evidence that individual profiles were accessed or that internal systems beyond the public website were compromised. Initial findings suggested the encrypted credentials were likely acquired through unauthorized access to an external service provider rather than through direct infiltration of ICANN's infrastructure. The organization forced password resets for all affected accounts as a precautionary measure, though it noted the hashed passwords were cryptographically protected and not easily reversible to plaintext.
The breach exposed no financial data or operational systems, limiting its immediate impact to profile management functions. ICANN publicly announced the incident on August 5, 2015, advising users to reset passwords and avoid password reuse across other services. While the specific hashing algorithm and salting practices were not disclosed, the organization acknowledged theoretical risks of attackers using precomputed hash tables to crack weaker passwords. Law enforcement was notified, though no attribution or motive for the breach was provided. The disclosure coincided with a separate password-reset incident at domain registrar Hover, though ICANN did not confirm any connection between the two events. User account functionality was restored following mandatory password changes, with no subsequent reports of unauthorized profile access or credential misuse tied directly to the breach.