Cyber Incident Victim: Egyptian Ministry of Tourism
Date:
Oct 2015
Location:
Egypt
Summary
A hacktivist group affiliated with Anonymous targeted multiple Egyptian government websites, including the Ministry of Tourism, in a coordinated cyberattack. The attackers defaced the sites with protest messages referencing human rights abuses and temporarily disrupted services, though officials stated only main pages were briefly compromised without deeper system breaches. The operation, claimed by "Anonymous Rabaa," emphasized solidarity with victims of past state violence while explicitly denying ties to banned Islamist movements. Evidence of the breaches, including mirrored site defacements and related content, was publicly shared by the perpetrators as part of their campaign against government crackdowns on dissent.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 22, 2015, the Egyptian branch of the hacktivist collective Anonymous launched coordinated cyber attacks against multiple Egyptian government websites, including the Presidency (presidency.gov.eg), Cabinet Decision Support Center (IDSC), Ministry of Tourism, Ministry of Planning, Supreme Council of Press, Center for Information and Decision Support, Egyptian Information Portal, Egyptian Observatory site, and National Planning Institute. The Presidency website went offline following the intrusion, which Cabinet spokesperson Hossam al-Qawish confirmed as a hacking attempt. Technical analysis revealed attackers compromised only the main page of the Presidency site for several minutes without penetrating critical systems or exfiltrating data. Simultaneously, the IDSC website experienced an attack that prompted its technical team to temporarily shut down the system as a containment measure. Evidence of the breaches, including defaced pages displaying a four-fingered Rabaa symbol and protest messages, was published on Zone-H and the hackers' Facebook page. Anonymous Rabaa claimed responsibility, citing the attacks as retaliation for security forces killing protesters during the 2013 Rabaa Square massacre and other human rights violations.
The group released screenshots and video footage documenting alleged government abuses while explicitly denying affiliation with Egypt’s banned Muslim Brotherhood. Their defacement messages demanded accountability for deaths during the 2013 Rabaa clashes, 2014 Sinai killings, and 2011 January Revolution, framing the attacks as continuity of prior operations like the August 2014 Cairo airport website breach that commemorated the massacre’s first anniversary. Immediate impacts included prolonged downtime for all targeted sites, though Egyptian officials minimized operational consequences by emphasizing no core systems or sensitive data were compromised. Anonymous Rabaa declared intentions to sustain attacks amid broader tensions over the government’s crackdown on Islamist groups, including former President Mohammed Mursi’s imprisonment. The incidents highlighted persistent vulnerabilities in Egyptian government web infrastructure to politically motivated defacements despite limited technical sophistication.