Cyber Incident Victim: Department of Interior and Local Government
Date:
Jul 2016
Location:
Philippines
Summary
Philippine government agencies experienced widespread cyberattacks involving distributed denial-of-service (DDoS) disruptions targeting 68 websites, including critical departments and smaller local portals, severely hindering administrative operations. The incidents coincided with heightened geopolitical tensions following an international ruling on maritime territories, with attacks persisting over multiple days before subsiding. Subsequently, two government sites were defaced with messages attributed to the "Chinese government," though the associated social media account was inactive. While officials acknowledged technical challenges in attributing the attacks, the timing led to suspicions of Chinese hacker involvement amid strained bilateral relations. The events underscored vulnerabilities across national and local digital infrastructure during periods of diplomatic friction.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 12, 2016, coinciding with the Permanent Court of Arbitration’s ruling in favor of the Philippines in its maritime dispute with China over territories in the West Philippine Sea, a series of distributed denial-of-service (DDoS) attacks targeted 68 Philippine government websites. The attacks commenced in the afternoon and persisted with consistent intensity through July 13, disrupting operations across high-profile agencies including the Department of Interior and Local Government, Department of National Defense, Department of Foreign Affairs, and the central bank. Smaller entities such as the Komisyon sa Wikang Pilipino, Manila City Hall, and local government unit portals were also affected, rendering many sites inaccessible and significantly impeding administrative functions. The scale of the disruption varied, with critical services experiencing severe operational challenges while non-sensitive sites faced intermittent outages.
By July 16, officials discovered two defaced government portals displaying a message attributed to the "Chinese government," though the associated Twitter account linked in the defacement belonged to an inactive Anonymous member. Filipino authorities acknowledged the difficulty in attributing the attacks but highlighted the timing’s correlation with the Hague ruling as a basis for suspecting Chinese involvement. No technical evidence or confirmed attribution was provided. The incident exacerbated existing geopolitical tensions, with officials characterizing bilateral relations as nearing a breaking point. Concurrently, the article noted the Philippines’ active hacktivist community, including local branches of Anonymous and LulzSec, suggesting potential retaliatory cyber actions against Chinese targets. The attacks subsided after July 13, though residual disruptions persisted intermittently across some platforms.