Cyber Incident Victim: Richland County Ambulance Service
Date:
Apr 2016
Location:
United States of America
Summary
Pro-ISIS hackers Team System DZ breached multiple Richland County government websites, including the Sheriff's Department and Ambulance Service, defacing them with the terrorist group's logo and a threatening message about an ISIS takeover. This marked the third such incident within a year targeting the same entities, following previous attacks on the Veterans Services and Sheriff's Department sites. The group, known for similar breaches at the University of Toronto and Isle of Wight, Virginia, temporarily disrupted the county's online services, which were subsequently restored.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 15, 2016, multiple Richland County, Wisconsin government websites were compromised and defaced by the Algeria-based hacking group Team System Dz. The attackers targeted at least ten county-operated domains, including the Richland County Government main site, Sheriff’s Department, Ambulance Service, Veterans Services, Recycling Committee, Health and Human Services, County Fair, Land Conservation Department, Parks Commission, and Emergency Management. The defacement replaced legitimate website content with a page displaying the official logo of the Islamic State (ISIS/Daesh) and a written message threatening an ISIS takeover. Team System Dz, which publicly supported ISIS in its defacements, previously hacked the University of Toronto and Isle of Wight, Virginia, in prior campaigns. This marked the third successful defacement of Richland County systems by the same group within a 12-month period, with prior intrusions specifically affecting the Veterans Services and Sheriff’s Department websites.
The repeated breaches disrupted public access to critical county services, though all affected sites were restored to operational status by the time the incident was publicly reported. No data theft or secondary malware deployment was documented in the defacement. Zone-h.org archived technical evidence of the compromises, confirming the defacements followed standard web server intrusion patterns. County administrators faced public scrutiny over recurring security failures, as the group exploited unchanged vulnerabilities across three separate incidents. The attacks highlighted systemic risks to local government digital infrastructure, though no long-term operational or financial impacts were disclosed in available reporting. Restoration efforts focused on removing defaced content without detailing security upgrades or attribution investigations.