Cyber Incident Victim: AlJazira Bank
Date:
Feb 2015
Location:
Saudi Arabia
Summary
A hacktivist group identifying as "The oppressed defenders" executed a distributed denial-of-service attack against Saudi Arabia's AlJazira bank, disrupting its online banking and e-services for over thirty minutes. The attackers cited human rights violations by the Saudi regime as motivation, specifically referencing political imprisonments and oppressive policies, while issuing warnings to the kingdom's leadership through communications with media. This incident followed similar disruptive actions against other Saudi financial institutions described by the group as preliminary warnings, with threats of intensified cyber attacks unless governmental policies changed. Services were restored following the temporary disruption.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 17, 2015, hacktivist group "The oppressed defenders" executed a distributed denial-of-service (DDoS) attack against Saudi Arabia's AlJazira Bank, disrupting its online banking and e-service domains. The attack forced these systems offline for over thirty minutes, preventing customer access to digital services. The group claimed responsibility through direct communication with media outlet HackRead, explicitly linking the attack to protests against human rights violations under Saudi King Salman bin Abdulaziz’s regime. Hackers cited the Saudi government’s creation of an oppressive security environment, violent reactions to citizens, and detention of over 30,000 political prisoners as justification. They framed the DDoS as a direct warning to the monarchy, demanding policy changes to end systemic abuses. The attackers emphasized this was not an isolated incident but part of an escalating campaign against Saudi financial infrastructure.
This incident followed a series of prior cyber operations by the same group against Saudi financial institutions Samba, Alahli, and Riyad Bank, which the hackers characterized as preliminary warnings. In their statement, the group threatened "new and more powerful cyber attacks" targeting additional Saudi financial entities unless the regime altered its treatment of citizens and addressed human rights concerns. The attackers explicitly tied future operations to the government’s response, indicating attacks would intensify if demands remained unmet. AlJazira Bank restored its online services by the time HackRead published its report on the incident. No technical details regarding attack mitigation or institutional response were disclosed in the available source material. The incident demonstrated the group’s sustained focus on Saudi financial sector disruption as leverage for political change.