Cyber Incident Victim: Azerbaijani E-Government portal
Date:
Jan 2016
Location:
Azerbaijan
Summary
Armenian hacker group Monte Melkonian Cyber Army conducted a disruptive cyberattack against Azerbaijani government infrastructure, employing DDoS tactics to temporarily disable critical portals including the E-Government platform, tax authority, and state body resources. The attackers further breached servers under the presidential administration, exfiltrating and leaking sensitive personal data encompassing names, email addresses, encrypted passwords, ID documents, and passport details belonging to over 80,000 citizens. This incident occurred amid heightened cyber hostilities linked to the Nagorno-Karabakh conflict, following reciprocal attacks between hacker groups from both nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 5 motives | 8 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 28, 2016, the Monte Melkonian Cyber Army (MMCA), an Armenian hacker group, executed a coordinated cyber attack against multiple Azerbaijani government online portals. The attackers deployed distributed denial-of-service (DDoS) techniques to disrupt access to Azerbaijan's E-Government Portal (e-gov.az), the Ministry of Taxes website (taxes.gov.az), and the central internet resource for state bodies (gov.az). This disruption coincided with Armenian Army Day celebrations, which the hackers cited as motivation for the operation. Following the DDoS attacks, MMCA penetrated the servers of Azerbaijan's Civil Service Commission (csc.gov.az), an agency operating under the President's administration. The breach resulted in the theft of sensitive citizen data from government databases, which the hackers subsequently leaked publicly.
The compromised data included two separate CSV files containing extensive personal information. The first file exposed names, email addresses, and encrypted passwords for 76,211 Azerbaijani citizens. The second file contained identity documents, images, usernames, passwords, and additional personal details of thousands more individuals. A third dataset comprising names, emails, and encrypted passwords for 5,960 citizens was also leaked, with analysis confirming this information had never previously appeared in public breaches. The attack represented a significant compromise of citizen data, exposing thousands to potential identity theft and fraud risks. This incident occurred within the context of ongoing cyber hostilities between Armenian and Azerbaijani hacking groups, exacerbated by the unresolved Nagorno-Karabakh conflict. One week prior, Azerbaijani hackers had conducted retaliatory attacks against Armenian government websites, including diplomatic portals in 40 countries, highlighting the cyclical nature of this digital conflict between the two nations.