Cyber Incident Victim: Ghana
Date:
Jan 2015
Location:
Ghana
Summary
A Ghanaian government's primary websites were compromised and rendered offline by the hacker group Alsancak Tim, which identified itself as a nationalist Turkish collective. The attackers defaced the sites with their branding and listed 11 targeted domains on their social media. Officials initiated restoration efforts and an investigation into the breach. This incident followed previous cyber intrusions against the government, including the justice ministry's site during an international dispute and simultaneous attacks on private banks. The group promoted an anti-oppression ideology online, though their specific motivations for this attack weren't disclosed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 21, 2015, multiple Ghanaian government websites experienced a coordinated cyberattack that rendered the majority of official domains inaccessible, including the primary government portal. Hackers identifying as "Alsancak Tim" defaced the compromised sites with a message declaring "Hacked by Alsancak Tim," accompanied by the group's nationalist Turkish branding visible on their social media profiles. Ghana's deputy communications minister confirmed the incident, stating technical teams were working to restore services by the end of the day while initiating an investigation into the perpetrators. The attackers listed 11 specific Ghanaian government websites on their Facebook page under the tagline "injustice, oppression and war with all our might," though full restoration timelines remained unspecified at the time of reporting. This disruption occurred against a backdrop of prior cybersecurity incidents affecting Ghana, including a 2012 defacement of the justice ministry's website during a diplomatic dispute over an impounded Argentine naval frigate.
Historical vulnerabilities were further evidenced by simultaneous cyber intrusions targeting two private Ghanaian banks in 2012. The Alsancak Tim attack coincided with heightened global attention on cybersecurity following the compromise of U.S. Central Command's social media accounts by Islamic State-affiliated hackers the preceding week. While the incident caused immediate operational disruptions to Ghana's digital government services, no data theft or secondary impacts were confirmed in initial reports. Restoration efforts focused on bringing critical websites back online, with authorities withholding technical details about the attack vector or potential collateral damage to other systems. The event highlighted persistent cybersecurity challenges for Ghana's public institutions amid evolving transnational hacker activities.