Cyber Incident Victim: Anonymous
Date:
Jul 2016
Location:
United States of America
Summary
OurMine conducted a DDoS attack against Wikileaks, temporarily disabling the site in retaliation against Anonymous. This followed Anonymous's prior doxxing of OurMine members after an earlier attack on the same target. The conflict originated from disputes between the hacker groups, with OurMine alleging persistent harassment by an Anonymous-affiliated account. While services were restored, the incident demonstrated disruptive consequences for critical information resources amid inter-group rivalries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In December 2015, the hacker group OurMine executed a Distributed Denial of Service (DDoS) attack against Wikileaks' website, temporarily crashing its servers by overwhelming them with artificial traffic. This initial attack occurred during a period when OurMine openly advertised its willingness to "DDoS/hack anyone for no reason." The incident prompted a response from Anonymous, the decentralized hacktivist collective known for operations against ISIS, the KKK, and financial institutions. Anonymous publicly demanded OurMine cease targeting Wikileaks and subsequently doxxed the group—publishing personal information allegedly identifying OurMine's members. OurMine disputed the accuracy of this leaked information, which was later removed from public access. The conflict between the two groups persisted unresolved for over six months following this exchange.
On July 6, 2016, OurMine launched a second DDoS attack against Wikileaks, explicitly framing it as retaliation against Anonymous. The group claimed an Anonymous-affiliated account holder had continued harassing them since the initial dispute, motivating the renewed offensive. OurMine proactively notified technology news outlet The Next Web (TNW) about the attack, though Wikileaks restored service after temporary downtime. The article notes the inherent challenges in rapidly mitigating DDoS attacks due to their varied execution methods. Anonymous did not respond to TNW's request for comment regarding the 2016 incident. While Wikileaks regained functionality, the attack highlighted operational vulnerabilities during inter-group conflicts, with the article observing collateral damage to a platform widely utilized for exposing institutional misconduct.