Cyber Incident Victim: University of Lisbon
Date:
Feb 2015
Location:
Portugal
Summary
A cyberattack targeted the University of Lisbon's Institute of Social Sciences, with the hacker group Sudoh4k3rs breaching its systems and leaking administrative passwords to demand the release of seven individuals arrested for alleged ties to Anonymous Portugal. The attackers claimed the action was retaliation for the arrests and threatened further attacks against governmental and academic entities until detainees were freed, framing their activities as opposition to corrupt governance. Those arrested, including the founder of a whistleblowing site, were suspected of involvement in Anonymous Portugal’s prior cyber operations, which had compromised multiple Portuguese ministries, law enforcement agencies, financial institutions, and religious entities by leaking confidential data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On February 27, 2015, the hacker group Sudoh4k3rs executed a cyber attack against the University of Lisbon’s Institute of Social Sciences webpage in retaliation for the arrest of seven individuals linked to Anonymous Portugal the previous day. The attackers breached the university’s system in the early morning hours, compromising and publicly leaking administrative passwords that granted access to the website’s backend. Sudoh4k3rs issued a demand via their Facebook page for the immediate release of the detained suspects, threatening continued cyber attacks against university and governmental entities until their condition was met. The group identified itself as “hacktivists” opposing what they characterized as corrupt governments in Portugal and globally, framing their actions as serving public interests. This incident occurred within 24 hours of a coordinated law enforcement operation codenamed C4R4T0S (Caretos), which resulted in arrests across the Lisbon and Porto metropolitan regions.
The arrests targeted individuals aged 17 to 40 suspected of involvement with Anonymous Portugal, a group active since 2011 and accused of cyber terrorism, including attacks on the Public Ministry, Justice Ministry, Attorney General’s portal, PSP and GNR police forces, Bank of Portugal, Novo Banco, and the Cardinal Patriarch of Lisbon. Among those detained was Rui Cruz, founder of the whistleblowing platform Tugaleaks, while fourteen others were formally named as suspects. Police conducted 24 house searches, seizing computer systems for forensic analysis. Anonymous Portugal’s historical activities involved infiltrating public and private entities to exfiltrate and leak confidential data online. The Sudoh4k3rs attack on the University of Lisbon exemplified the immediate retaliatory escalation following the arrests, directly impacting the institution’s digital infrastructure and exposing administrative vulnerabilities. No further technical details about the university’s incident response or containment measures were disclosed in available reporting.