Cyber Incident Victim: Downtown Alliance
Date:
Mar 2016
Location:
United States of America
Summary
A hacker group conducted distributed denial-of-service attacks against multiple Salt Lake City organizations, including police, airport, banking, and business alliance websites, in protest of a police shooting incident involving a critically injured Somali refugee teenager. The attackers claimed responsibility for temporarily disabling the sites to demand accountability for the officers involved, citing parallels to previous hacktivist actions against law enforcement agencies following similar incidents. While most targeted websites were restored shortly after the attacks, one banking portal remained offline at the time of initial reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 12, 2016, the New World Hackers (NWH) group executed distributed denial of service (DDoS) attacks against multiple Salt Lake City entities, including the Downtown Alliance, Salt Lake City Police Department, Salt Lake City International Airport, and First Utah Bank. The attacks were publicly claimed by NWH as retaliation for the police shooting of 17-year-old Somali refugee Abdi Mohamed, who sustained three gunshot wounds to his torso during an altercation in downtown Salt Lake City. Mohamed remained in critical condition and a coma as of March 13, according to local reports. NWH explicitly stated their intent to continue targeting law enforcement websites until the involved officer faced arrest, framing the cyberattacks as a protest against police violence. The group utilized DDoS tactics to overwhelm and temporarily disable the targeted websites, mirroring their previous high-profile attacks on organizations including BBC News, HSBC UK, and Donald Trump's campaign website.
The coordinated DDoS campaign succeeded in taking First Utah Bank's website offline at the time of media reporting on March 14, though other affected sites including the Downtown Alliance's had been restored by then. Witness accounts cited in police reports indicated Mohamed had picked up a broken broomstick during a physical altercation prior to police arrival, though the exact circumstances prompting officers to fire remained unclear. This incident followed established patterns of hacktivist responses to police shootings, with historical precedents including Anonymous-led operations protesting the killings of Michael Brown in Ferguson and Samuel DuBose in Cincinnati. The attacks disrupted public access to essential municipal services and financial institutions, though no data breaches or permanent system compromises were reported. Restoration efforts prioritized returning affected websites to operational status, with no documented countermeasures or law enforcement responses to the cyberattacks mentioned in available reports.