Cyber Incident Victim: Holy See
Date:
Apr 2015
Location:
Holy See
Summary
The Vatican's official website was disrupted by a Turkish hacker using the alias THTHerakles, who demanded an apology for Pope Francis' characterization of historical mass killings of Armenians as genocide. The attacker claimed responsibility via social media, asserting the main server remained compromised despite temporary restoration of site access, and threatened continued disruptions until the Vatican retracted the statement. Turkey's government concurrently condemned the Pope's remarks as historically inaccurate, with its foreign minister criticizing the use of religious platforms for what he deemed unfounded allegations, while the organization ultimately redirected its website to an alternate server following the cyberattack.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 13, 2015, the official Vatican City website was rendered inaccessible following a cyberattack claimed by a Turkish hacker operating under the alias "@THTHerakles." The attack occurred shortly after Pope Francis publicly described the early 20th-century mass killings of Armenians by Ottoman Turks as "genocide" during a commemorative event. The hacker explicitly linked the attack to the Pope’s remarks, demanding an apology from the Vatican and threatening to maintain the disruption until one was issued. Initial disruption lasted approximately one hour, after which the site temporarily resumed operation. However, the attacker asserted that the primary server remained compromised, indicating a persistent vulnerability. Screenshots of tweets from @THTHerakles documented the attack timeline, including claims of responsibility and warnings of continued targeting. The hacker emphasized respect for the Pope’s religious role but condemned his characterization of historical events as biased and factually incorrect.
The incident drew parallel diplomatic criticism from the Turkish government. Foreign Minister Mevlut Cavusoglu publicly denounced the Pope’s use of "genocide" on social media, calling it historically and legally unfounded while accusing religious institutions of exacerbating animosity through unsubstantiated claims. Technical measures were implemented by Vatican administrators to restore access, including redirecting the website to an alternate server. No evidence of data exfiltration or secondary system compromises was disclosed in the source material. The attack highlighted the intersection of geopolitical tensions and cyber operations, with immediate service disruption as the primary operational impact. At the time of reporting, the attacker’s demands remained unmet, and the website’s functionality relied on contingency infrastructure.