CSIDB logo
Incident

Sakarya Gaz Dağıtım Kurumu

Incident posture

Attack window
Feb 2014
Location
Turkey
Status
Historical
CIA posture
Available to members
Updated
2026-01-21 15:17

Linked entities

Victim
Sakarya Gaz Dağıtım Kurumu
Threat actors
1 actor
Sources
1 source

Timeline

Occurred
Feb 2014
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

Hacktivist group RedHack conducted cyberattacks against Turkish entities, including the Gas Distribution Authority of Sakarya, in protest of restrictive internet legislation. The organization's website was defaced to display gas prices as zero alongside accusations of government corruption. Concurrently, the group leaked police contact details, municipal records from Amasya City, and Ministry of Education financial documents alleging inflated expenditures. These actions aimed to expose perceived institutional malpractice and align with broader public demonstrations challenging the law's impact on free expression.

Motives

Detailed motive labels are available to members.

2 motives

TTPs

Detailed technique labels are available to members.

2 techniques

Description

In February 2014, the hacktivist group RedHack conducted a series of cyberattacks against Turkish government and municipal entities in protest of the country’s newly enacted internet censorship law. The group first leaked approximately two dozen phone numbers belonging to police officials described as "murderer police chiefs and superintendents," framing this action as an initial phase of their campaign. They subsequently defaced the official website of Kars Municipality (kars.bel.tr), replacing its content with protest messages condemning the internet restrictions. The Gas Distribution Authority of Sakarya (agdas.org) was directly targeted next, with attackers altering the website to display gas prices as zero alongside a political statement claiming gas should be free since the government was "stealing enough from the people." This defacement included a visible modification of pricing information, accompanied by a screenshot as proof of compromise.

RedHack expanded their operations by breaching the City of Amasya’s systems, exfiltrating and publicly leaking AKP (Justice and Development Party) membership applications. They concurrently attacked the Turkish Ministry of Education, extracting and publishing school expenditure records and invoices on the JustPaste.It platform. The group highlighted specific irregularities in water bills as evidence of systemic corruption within the ministry. These coordinated attacks occurred alongside widespread street protests across Turkey, with both citizens and international entities like the European Union criticizing the internet law for restricting free speech. An EU spokesperson publicly urged Turkey to revise the legislation to meet European transparency standards, emphasizing public discontent with the government’s actions. The incidents collectively demonstrated hacktivist exploitation of digital vulnerabilities to amplify political dissent, resulting in temporary service disruptions, reputational damage to targeted entities, and unauthorized exposure of sensitive administrative and personal data.

Sources

Sources available to members: 1 source.

CSIDB