Cyber Incident Victim: Kingdom of Bahrain
Date:
Nov 2022
Location:
Bahrain
Summary
Hackers targeted government websites during parliamentary elections, temporarily disrupting access to the parliament's site, the state news agency, and the election platform from abroad. An unknown group called Al-Toufan claimed responsibility, citing opposition to authorities' persecution and calls to boycott the elections, while the kingdom attributed the attack to an unnamed state-backed actor attempting to derail voting. Despite the disruptions, all systems were restored, and officials reported voting proceeded smoothly across polling sites without direct impact on the electoral process. The incident occurred amid longstanding political tensions and boycott campaigns by banned opposition groups.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On November 12, 2022, during Bahrain’s parliamentary and municipal elections, government websites experienced cyberattacks that disrupted access to critical election-related platforms. The Bahraini Interior Ministry confirmed the attacks, though it did not specify all affected systems. The state-run Bahrain News Agency (BNA) and the parliament’s website became unreachable, with the election website also inaccessible internationally for several hours. A previously unknown group calling itself Al-Toufan ("The Flood" in Arabic) claimed responsibility through social media, posting screenshots of defaced pages. Al-Toufan cited Bahrain’s political repression and opposition to the elections as motivations, aligning with calls by banned Shiite groups for an election boycott. The Interior Ministry framed the attacks as attempts to undermine voter participation and spread negative messaging but asserted citizens remained undeterred. Bahrain’s government later characterized the incident as a "state-backed cyberattack" aimed at disrupting the electoral process, though it did not attribute the attack to a specific nation-state. Technical teams restored the BNA and election websites, with authorities emphasizing that all systems became operational and voting proceeded unaffected. State television broadcast footage of polling stations operating normally, and official reports described the election as unfolding "smoothly" across 55 locations.
The attacks occurred against a backdrop of sustained political tensions in Bahrain, where authorities have suppressed dissent since the 2011 Arab Spring protests. The government’s response included public reassurances about system integrity but did not disclose technical mitigation details or evidence supporting the state-backed attribution claim. Impacts were limited to temporary website outages, with no reported compromise of voting infrastructure or voter data. The incident highlighted ongoing divisions, as opposition groups had organized protests against the elections days earlier, including during Pope Francis’s visit. Bahrain’s decade-long crackdown—marked by imprisonments, deportations, citizenship revocations, and media closures—fueled the discontent referenced in Al-Toufan’s statements. International observers like Freedom House have criticized Bahrain’s democratic backsliding, noting its transformation from a perceived reform model to a highly repressive state. The election proceeded as scheduled, resulting in the selection of 40 members for the Council of Representatives, the parliament’s elected lower house. Bahrain’s monarchy retains control over the upper Consultative Council, which is appointed by the king. Despite the cyber disruptions, the government maintained electoral continuity, reflecting its broader strategy of insulating institutional processes from opposition challenges.