Cyber Incident Victim: Health and Human Services
Date:
Apr 2016
Location:
United States of America
Summary
A pro-ISIS hacking group compromised multiple Richland County government websites, including Health and Human Services, through defacement attacks displaying terrorist propaganda and threats. The attackers, known as Team System DZ, previously breached the same county's systems twice within a year, targeting departments such as the Sheriff's Office and Veterans Services with similar messages. The incident marked the group's recurring pattern of disruptive intrusions, following prior compromises of other entities including the University of Toronto and Isle of Wight, Virginia. All affected sites were restored following the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 15, 2016, multiple Richland County, Wisconsin government websites were compromised and defaced by the Algeria-based hacking group Team System Dz. The attackers targeted at least ten county-operated domains, including Health and Human Services, Sheriff’s Department, Ambulance Service, Veterans Services, Recycling Committee, County Fair, Land Conservation Department, Parks Commission, and Emergency Management. The defacement involved replacing legitimate website content with the official logo of the Islamic State (Daesh) and a threatening message endorsing the terrorist organization's ideology. This marked the third successful attack by Team System Dz against Richland County infrastructure within a twelve-month period, following prior compromises of the Veterans Services and Sheriff’s Department websites with similar pro-ISIS content. The group had previously conducted cyber operations against other international targets, including the University of Toronto and Isle of Wight, Virginia government systems.
County administrators restored all affected websites to normal operation before the publication of the incident report. No data theft or extended service disruption beyond the defacements was documented in available records. The repeated breaches indicated persistent vulnerabilities in the county's web infrastructure security posture, as attackers successfully penetrated the same systems multiple times despite prior incidents. Zone-h.org archived technical evidence confirming the defacements. The incident exposed operational risks across multiple critical county service domains simultaneously, though no specific functional impacts beyond temporary website unavailability were verified in source material. Restoration efforts focused on removing malicious content without public documentation of additional security enhancements following the attacks.