Cyber Incident Victim: Arizona Department of Homeland Security
Date:
May 2014
Location:
United States of America
Summary
The Arizona Department of Homeland Security's website and server were compromised and defaced by a Turkish hacker known as Swan, who also targeted the Arizona Commission of Indian Affairs site. The defacement displayed an anti-violence message related to the Middle East, demonstrating vulnerabilities in U.S. defense systems. The affected websites were restored to normal operation following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On May 26, 2014, the official website of the Arizona Department of Homeland Security (azdohs.gov/Apps/ and homelandsecurity.az.gov/Apps/) and the Arizona Commission of Indian Affairs website (indianaffairs.state.az.us and azcia.gov/database/) were compromised and defaced by a Turkish hacker operating under the alias Swan. The attacker replaced the legitimate web content with a defacement page displaying the message "Hacked By Swan ( Stop Violence in Middle East !.. )" as an anti-violence statement directed at the Arizona Department of Homeland Security. The breach affected multiple subdomains and directories across both state agencies, with Zone-h.org mirror records documenting four distinct compromised URLs. The defacement demonstrated unauthorized access to web servers hosting government domains, though the specific intrusion method remained unspecified in available reporting. No data theft or secondary malicious payloads were mentioned in connection with the incident.
The attack highlighted vulnerabilities in Arizona's state-level homeland security infrastructure, with the perpetrator explicitly targeting multiple government digital assets in a coordinated defacement campaign. All affected websites were restored to normal operation by the time the incident was publicly reported later on May 26, 2014. The breach prompted public commentary regarding the susceptibility of U.S. defense-related entities to cyber intrusions, though no official statements from the Arizona Department of Homeland Security or law enforcement agencies were cited. No disruptions to physical operations or follow-on attacks were documented in relation to the incident. The restoration timeframe suggested existing incident response protocols were activated, but no technical details regarding containment measures or forensic investigations were disclosed in the available source material.