CSIDB logo
Incident

Anonymous

Incident posture

Attack window
Jul 2016
Location
United States of America
Status
Historical
CIA posture
Available to members
Updated
2026-07-16 21:24

Linked entities

Victim
Anonymous
Threat actors
2 actors
Sources
1 source

Timeline

Occurred
Jul 2016
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

OurMine conducted a DDoS attack against Wikileaks, temporarily disabling the site in retaliation against Anonymous. This followed Anonymous's prior doxxing of OurMine members after an earlier attack on the same target. The conflict originated from disputes between the hacker groups, with OurMine alleging persistent harassment by an Anonymous-affiliated account. While services were restored, the incident demonstrated disruptive consequences for critical information resources amid inter-group rivalries.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

In December 2015, the hacker group OurMine executed a Distributed Denial of Service (DDoS) attack against Wikileaks' website, temporarily crashing its servers by overwhelming them with artificial traffic. This initial attack occurred during a period when OurMine openly advertised its willingness to "DDoS/hack anyone for no reason." The incident prompted a response from Anonymous, the decentralized hacktivist collective known for operations against ISIS, the KKK, and financial institutions. Anonymous publicly demanded OurMine cease targeting Wikileaks and subsequently doxxed the group—publishing personal information allegedly identifying OurMine's members. OurMine disputed the accuracy of this leaked information, which was later removed from public access. The conflict between the two groups persisted unresolved for over six months following this exchange.

On July 6, 2016, OurMine launched a second DDoS attack against Wikileaks, explicitly framing it as retaliation against Anonymous. The group claimed an Anonymous-affiliated account holder had continued harassing them since the initial dispute, motivating the renewed offensive. OurMine proactively notified technology news outlet The Next Web (TNW) about the attack, though Wikileaks restored service after temporary downtime. The article notes the inherent challenges in rapidly mitigating DDoS attacks due to their varied execution methods. Anonymous did not respond to TNW's request for comment regarding the 2016 incident. While Wikileaks regained functionality, the attack highlighted operational vulnerabilities during inter-group conflicts, with the article observing collateral damage to a platform widely utilized for exposing institutional misconduct.

Sources

Sources available to members: 1 source.

CSIDB