Cyber Incident Victim: High Commission of Ghana
Date:
Nov 2016
Location:
India
Summary
A hacker affiliated with the Powerful Greek Army breached two high commission websites in India via SQL injection, compromising nearly 200 user credentials and leaking partial database contents to force security fixes. The attacker, Kapustkiy, claimed the High Commission of Ghana and another diplomatic mission failed to address vulnerabilities he previously reported despite prior engagement with their administrator and public acknowledgments from Indian authorities regarding his past security assistance. The breach exposed login details, prompting the Ghanaian mission to confirm the incident and pledge remediation, while the other entity remained unresponsive at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On November 26, 2016, a hacker identifying as Kapustkiy, affiliated with the group Powerful Greek Army, breached the websites of the High Commission of Ghana and the High Commission of Fiji in India. The attacker exploited an SQL injection vulnerability to access databases containing login credentials for nearly 200 user accounts. Kapustkiy publicly disclosed portions of the compromised data, stating this action was intended to pressure administrators to address security weaknesses. The breach exposed administrative credentials but did not reveal evidence of further data manipulation or exfiltration beyond the leaked samples. Both high commissions operated under shared technical management, with Yatin Patel identified as overseeing the affected websites.
Kapustkiy claimed the attack followed repeated unsuccessful attempts to alert Indian authorities about unpatched vulnerabilities in embassy websites. He had previously contacted Patel, who allegedly promised remediation but failed to implement fixes despite follow-up communications. Notably, Indian officials had publicly acknowledged Kapustkiy’s prior security disclosures through Sanjay Kumar Verma, Joint Secretary for eGovernance and IT, who thanked him for identifying flaws and confirmed ongoing remediation efforts. The High Commission of Ghana confirmed the breach by November 29 and committed to resolving the issue, while the High Commission of Fiji’s response remained unconfirmed at the time of reporting. No additional operational disruptions or post-breach attacker communications were documented in available sources.