Cyber Incident Victim: Afyonkarahisar Provincial Disaster and Emergency Management
Date:
Jan 2014
Location:
Turkey
Summary
A Kurdish hacker group identifying as Anonymous Kurdistan and Muhmad Emad breached two Turkish government websites operated by the Afyonkarahisar Provincial Disaster and Emergency Management, replacing content with a political message demanding an end to alleged Turkish support for ISIS. The defacement displayed imagery portraying the Prime Minister as a dictator and included explicit language condemning ISIS supporters. Turkish media reported government efforts to suppress evidence of alleged terrorist ties, while officials denied accusations of facilitating extremist groups. The compromised websites remained inaccessible following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On January 2, 2015, a hacker identifying as Anonymous Kurdistan and Muhmad Emad compromised two Turkish government websites operated by Afyonkarahisar Provincial Disaster and Emergency Management. The attacker replaced the sites' content with a defacement page containing political messages directed at the Turkish government and ISIS. The defacement featured an image portraying Turkish Prime Minister Recep Tayyip Erdoğan as a dictator alongside the text "#OPTurkey Turkey Stop supporting ISIS.. Fuck isis & All Who Support Them Fuck Gov Turk." Explicit language condemned both ISIS and entities supporting the group. The compromised domains included the primary government site http://www.afyonab.gov.tr and a mirror documented on Zone-h.org (ID 23636899). Both websites became inaccessible following the intrusion, remaining offline at the time of initial media reporting later that day.
Turkish media outlets reported allegations that the government was attempting to suppress evidence of connections to terrorist organizations, specifically citing claims of Turkish support for ISIS. The government issued formal denials rejecting accusations of aiding terrorist activities or permitting transit through Turkish territory to conflict zones in Syria. No technical details regarding attack vectors, data exfiltration, or network containment procedures were disclosed in available reports. The incident's primary observable impacts included temporary disruption of emergency management web services and public dissemination of geopolitical accusations through digital vandalism. Turkish authorities did not acknowledge successful restoration timelines or security remediation measures in the immediate aftermath.