Cyber Incident Victim: Sakarya Gaz Dağıtım Kurumu
Date:
Feb 2014
Location:
Turkey
Summary
Hacktivist group RedHack conducted cyberattacks against Turkish entities, including the Gas Distribution Authority of Sakarya, in protest of restrictive internet legislation. The organization's website was defaced to display gas prices as zero alongside accusations of government corruption. Concurrently, the group leaked police contact details, municipal records from Amasya City, and Ministry of Education financial documents alleging inflated expenditures. These actions aimed to expose perceived institutional malpractice and align with broader public demonstrations challenging the law's impact on free expression.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In February 2014, the hacktivist group RedHack conducted a series of cyberattacks against Turkish government and municipal entities in protest of the country’s newly enacted internet censorship law. The group first leaked approximately two dozen phone numbers belonging to police officials described as "murderer police chiefs and superintendents," framing this action as an initial phase of their campaign. They subsequently defaced the official website of Kars Municipality (kars.bel.tr), replacing its content with protest messages condemning the internet restrictions. The Gas Distribution Authority of Sakarya (agdas.org) was directly targeted next, with attackers altering the website to display gas prices as zero alongside a political statement claiming gas should be free since the government was "stealing enough from the people." This defacement included a visible modification of pricing information, accompanied by a screenshot as proof of compromise.
RedHack expanded their operations by breaching the City of Amasya’s systems, exfiltrating and publicly leaking AKP (Justice and Development Party) membership applications. They concurrently attacked the Turkish Ministry of Education, extracting and publishing school expenditure records and invoices on the JustPaste.It platform. The group highlighted specific irregularities in water bills as evidence of systemic corruption within the ministry. These coordinated attacks occurred alongside widespread street protests across Turkey, with both citizens and international entities like the European Union criticizing the internet law for restricting free speech. An EU spokesperson publicly urged Turkey to revise the legislation to meet European transparency standards, emphasizing public discontent with the government’s actions. The incidents collectively demonstrated hacktivist exploitation of digital vulnerabilities to amplify political dissent, resulting in temporary service disruptions, reputational damage to targeted entities, and unauthorized exposure of sensitive administrative and personal data.