Cyber Incident Victim: National Crime Agency
Date:
Sep 2015
Location:
United Kingdom
Summary
A distributed denial of service attack targeted a UK law enforcement agency's website, causing temporary downtime. The group Lizard Squad claimed responsibility via social media, framing the incident as promotional outreach for an upcoming version of their attack tool. This followed the agency's recent arrests of six individuals linked to the group's DDoS service, which had been used against gaming platforms and other online entities. The attackers publicly announced new capabilities while the agency continued outreach to additional suspected users of the tool.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 1, 2015, the UK National Crime Agency (NCA) website experienced a distributed denial of service (DDoS) attack claimed by the group Lizard Squad. The attack rendered the NCA website inaccessible for over two hours during the morning, as confirmed by SkyNews. Lizard Squad publicly acknowledged responsibility through a post on their Twitter account at approximately 9:00am BST, which included a link to the NCA website and the hashtag #offline alongside an image suggesting the site’s inaccessibility. This incident occurred three days after the NCA had disclosed the arrest of six teenagers on August 28, 2015, for utilizing Lizard Stresser—a DDoS tool operated by Lizard Squad. The agency had also initiated contact with approximately 50 additional UK individuals who had registered for the service but had not yet conducted attacks.
The arrested individuals, all released on bail, were linked to DDoS attacks targeting gaming platforms, retail outlets, and media sites, including Microsoft’s Xbox Live and Sony’s PlayStation Network. Following the NCA website disruption, Lizard Squad used the incident to promote its services, tweeting a message indicating a "new weapon coming soon," implying an upcoming iteration or enhancement of Lizard Stresser. The group had previously suggested testing the tool prior to the attack. The NCA did not report additional operational disruptions beyond the temporary website outage, nor did it disclose specific mitigation measures taken during or after the incident. Lizard Squad’s actions framed the attack both as retaliation for the arrests and as a marketing opportunity for their DDoS-for-hire operations.