South African Broadcasting Corporation

Summary

The South African Broadcasting Corporation experienced cyberattacks by a hacktivist group aligned with Anonymous, which targeted its websites and disrupted television and radio broadcasts for approximately four hours. The attackers, operating under the name Anonymous Africa, launched distributed-denial-of-service attacks in protest of alleged news censorship, accusing the broadcaster of failing to cover anti-government demonstrations and acting as a government mouthpiece. The group used social media to claim responsibility, share critical media coverage, and conduct a poll showing majority support for their actions. The broadcaster confirmed the incidents and denounced the perpetrators, while its leadership faced prior criticism for editorial policies restricting protest coverage.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On June 12, 2016, the South African Broadcasting Corporation (SABC) experienced cyberattacks targeting its digital infrastructure, claimed by a hacktivist operating under the Anonymous Africa banner. The attacker launched distributed-denial-of-service (DDoS) attacks against SABC’s websites, disrupting its main television channel and radio stations 5FM and SAFM for approximately four hours. The SABC’s spokesperson, Kaizer Kganyago, confirmed the incident and denounced the perpetrator as a "coward," emphasizing the organization’s serious stance toward the breach. The disruption coincided with public accusations by Anonymous Africa that SABC had censored coverage of anti-government protests, labeling the broadcaster a government mouthpiece. The attacker used a dedicated Twitter account to announce responsibility for the attacks in real-time and shared a link to an Al-Jazeera article criticizing SABC’s editorial policies.

Anonymous Africa further engaged the public by initiating a Twitter poll asking whether SABC "deserved the attention" of the group, which garnered over 80% support from respondents. This incident followed prior actions by the same entity, including the leak of South African government employees’ personal data to protest internet censorship. The attacks highlighted existing tensions surrounding SABC’s editorial decisions, particularly Chief Operating Officer Hlaudi Motsoeneng’s "good news policy," which had drawn criticism for restricting coverage of public protests. No data theft or permanent system damage was reported, but the broadcaster’s online services experienced significant temporary downtime during the attack window. SABC did not disclose technical mitigation measures but affirmed its commitment to addressing the incident through official channels.

Sources

Sources available to members: 1 source.