Cyber Incident Victim: Central Bank of Turkey
Date:
Jan 2014
Location:
Turkey
Summary
The Central Bank of Turkey's website experienced a distributed denial-of-service (DDoS) attack by the RedHack hacktivist group, temporarily disrupting access to protest the financial institution's role in the devaluation of the Turkish lira against foreign currencies. The group also disclosed a cross-site scripting (XSS) vulnerability in the Ministry of Family and Social Policy's website, condemning child marriages and women's deaths, though no exploitation of this flaw was reported. Services for the central bank were restored shortly after the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 16, 2014, the RedHack hacktivist group executed a distributed denial-of-service (DDoS) attack against the Central Bank of Turkey’s official website (tcmb.gov.tr), disrupting its availability. The attack followed RedHack’s earlier leak of Turkcell employee phone numbers and was publicly claimed by the group as a protest against the Central Bank’s monetary policies, which they accused of enabling the devaluation of the Turkish lira against foreign currencies. The Financial Times had previously reported on political sensitivities surrounding potential interest rate hikes by the bank to stabilize the currency, contextualizing the hackers’ stated motive. The Central Bank’s website experienced operational disruption during the attack but was restored to functionality by the time the incident was reported in media outlets. No data breach or unauthorized access to financial systems was disclosed in connection with this event.
Concurrently, RedHack disclosed a cross-site scripting (XSS) vulnerability in the website of Turkey’s Ministry of Family and Social Policy (aile.gov.tr), though no disruptive attack against the ministry’s site was explicitly confirmed. The group linked this action to separate grievances over child marriages and women’s deaths in Turkey, framing it as part of a broader campaign targeting government entities. The Central Bank incident remained confined to temporary service interruption of its public-facing website, with no evidence of secondary exploits or data exfiltration. Restoration efforts succeeded in bringing tcmb.gov.tr back online without documented escalation or additional retaliatory measures by the attackers. The Ministry of Family and Social Policy’s vulnerability exposure did not result in reported operational impacts, leaving the Central Bank DDoS as the primary disruptive outcome of RedHack’s actions that day.