Cyber Incident Victim: Richland County Emergency Management
Date:
Apr 2016
Location:
United States of America
Summary
A pro-ISIS Algerian hacking group known as Team System Dz breached multiple Richland County government websites, including the Land Conservation Department, Sheriff’s Department, and Emergency Management, replacing content with terrorist propaganda featuring the Islamic State logo and threatening messages. This marked the third successful defacement by the same group within a year, following prior compromises of the Sheriff’s Department and Veterans Services sites. The attackers previously targeted other entities including the University of Toronto and Isle of Wight, Virginia. All affected county websites were restored following the incident, though the repeated breaches highlighted persistent vulnerabilities in the county's web infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 15, 2016, multiple Richland County, Wisconsin government websites were compromised and defaced by the Algeria-based hacking group Team System Dz. The attackers targeted at least ten county-operated domains, including the Richland County Land Conservation Department, Sheriff’s Department, Ambulance Service, Veterans Services, Recycling Committee, Health and Human Services, County Fair, Parks Commission, and Emergency Management. The defacement replaced legitimate site content with a page displaying the logo of the Islamic State (ISIS/Daesh) and a threatening message referencing the terrorist group’s agenda. Team System Dz, known for previous attacks on the University of Toronto and Isle of Wight, Virginia infrastructure, publicly claimed responsibility for the breach. This marked the third successful defacement of Richland County systems by the same group within a twelve-month period, with prior incidents affecting the Veterans Services and Sheriff’s Department websites through similar methods and messaging.
All compromised websites were restored to operational status by the time public reporting occurred on April 15, 2016, though the repeated breaches highlighted persistent vulnerabilities in the county’s digital infrastructure. No data theft, service disruption beyond the defacements, or additional post-restoration malicious activity was documented in available reports. The incident exclusively involved website defacements with propagandistic content, with no evidence of deeper network infiltration or secondary attacks. Historical patterns indicated Team System Dz consistently exploited security weaknesses in Richland County’s web-facing systems, raising questions about the implementation of corrective measures following prior compromises in 2015 and early 2016. County administrators did not publicly disclose technical details of the intrusion vector or specific remediation steps taken after the April 15 restoration.