Arizona State Legislature

Summary

A Turkish hacker using the alias "aLem!" defaced multiple Arizona government websites, including the State Legislature and House of Representatives, replacing their homepages with anti-U.S. messages and displaying a logo from the Turkish football club Eskişehirspor. The attacker, associated with the Turk Hack Team and active in defacements since 2007, compromised high-profile state sites, though the specific intrusion method remained unconfirmed. The incident mirrored recent football-related defacements during UEFA Euro 2016 but lacked direct sporting context between Turkey and the U.S. All affected websites were restored to normal operation shortly after the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 1, 2016, a Turkish hacker using the alias "aLem!" compromised and defaced three official websites belonging to the State of Arizona government: the Arizona State Legislature, Arizona House of Representatives, and the primary Arizona State website. The attacker replaced the homepages of all three sites with a custom page displaying an anti-United States political message and the logo of Eskişehirspor, a professional football club based in Eskişehir, Turkey. The defacement mirrored tactics observed in other geopolitical hacking incidents during the UEFA Euro 2016 tournament period, though no direct football-related connection existed between Turkey and the United States at that time. Security researchers noted the attacker's ability to breach multiple high-profile government domains suggested potential vulnerabilities in Arizona's web infrastructure, though no specific intrusion method was confirmed.

The incident represented one of the most significant defacements in the hacker's career, with records indicating "aLem!" had been active since 2007 and maintained affiliations with the Turk Hack Team, a prominent Turkish hacking collective. All affected websites were rendered temporarily inaccessible to the public during the defacement period, though no data theft or secondary compromises were reported. Arizona IT personnel detected the breach within hours and fully restored the legitimate websites by the time media reports emerged later that day. The defacer left no additional malware or persistent access mechanisms according to Zone-H archives documenting the incident. While the attack caused no permanent operational disruption, it highlighted security concerns regarding government web assets following multiple high-profile breaches across U.S. entities during that period.

Sources

Sources available to members: 1 source.