Cyber Incident Victim: John Holdren
Date:
Jan 2016
Location:
United States of America
Summary
A White House science advisor was targeted by hackers associated with the Crackas With Attitude group, who compromised his personal email and home telephone accounts through a spear-phishing attack against his spouse. The attackers obtained credentials by impersonating the victim to solicit login details for a shared internet service account, subsequently rerouting all calls to the Free Palestine Movement. Law enforcement databases previously breached by the group contained contact information enabling this intrusion. The incident followed a pattern of high-profile government official targeting by these hackers, including previous compromises of intelligence and law enforcement personnel. The White House acknowledged the breach and referred it to authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In October 2015, the hacking group Crackas With Attitude (CWA) initiated a campaign targeting U.S. government officials by breaching CIA Director John Brennan’s AOL email account. This activity expanded in January 2016 when CWA-affiliated hackers compromised John Holdren, Director of the White House Office of Science and Technology Policy. The attackers used spear phishing to target Holdren’s wife, Cheryl, impersonating Holdren via email to request their Comcast Xfinity account password. After obtaining the credentials, the hacker known as Fearz (@fearhax) accessed the account and reconfigured Holdren’s home telephone and email settings to forward all calls to the Free Palestine Movement. A member of CWA provided evidence of the breach to a journalist, including Holdren’s home phone number, which was verified through public records and a confirmation call answered by Free Palestine Movement founder Paul Larudee.
The White House confirmed Holdren was targeted and reported the incident to law enforcement, though the FBI did not publicly comment. CWA members, including Cracka and Cubed, disclosed that Holdren’s wife’s email address was identified in law enforcement databases the group had accessed during prior breaches in November 2015. The group had previously compromised high-profile officials such as FBI Deputy Director Mark Giuliano, Director of National Intelligence James Clapper, and White House Communications Director Jen Psaki, among others. Their activities included publishing over 2,000 law enforcement agents’ names and accessing sensitive databases, prompting an FBI alert in late 2015 about doxing risks. CWA claimed to have disbanded by January 2016, but members continued collaborating, with Cracka expressing anti-Israel sentiments during communications. The breach exposed vulnerabilities in personal accounts of senior officials and highlighted persistent threats from hacktivist groups exploiting social engineering tactics.