Cyber Incident Victim: Etowah County Sheriff's Office
Date:
Aug 2015
Location:
United States of America
Summary
The Etowah County Sheriff's Office website was compromised by Kurdish hacker MuhmadEmad, who replaced its content with an anti-ISIS message featuring a Kurdish flag and a profane statement against the Islamic State. The defacement, which also affected the Hardin Center's site, displayed a declaration supporting Kurdish forces and included contact information. Both organizations collaborated to address the breach, temporarily taking their websites offline after unsuccessful attempts to remove the unauthorized content. The attacker, previously associated with Anonymous Kurdistan, has targeted entities perceived as supporting ISIS or opposing Kurdish interests. While no explicit motive was confirmed, the incident aligns with the hacker's historical focus on anti-ISIS activism and opposition to Turkish military actions. Services were fully restored following remediation efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On Saturday, August 1, 2015, the official websites of the Etowah County Sheriff’s Office (etowahcountysheriff.com) and the Hardin Center for Cultural Arts (culturalarts.com) in Alabama were compromised by a hacker identifying as MuhmadEmad. Both websites displayed identical defacement pages featuring a Kurdish flag, a Gmail contact address, and the message «HaCKeD by MuhmadEmad, Long Live to peshmarga, KurDish HaCkerS WaS Here.» The defacement included explicit anti-Islamic State (ISIS) language. Tom Banks, Deputy Director of the Hardin Center, confirmed the websites were operational earlier that Saturday, indicating the intrusion occurred shortly before its discovery in the afternoon. The Sheriff’s Office acknowledged the breach immediately upon detection. Both organizations coordinated efforts to remove the unauthorized content and restore service, prioritizing the takedown of the defaced pages over maintaining website availability.
The attack rendered both websites inaccessible by 6:00 PM on the day of the incident. Restoration efforts faced initial challenges, as the Hardin Center unsuccessfully attempted to delete the defacement message before opting to disable the site entirely. Zone-h.org archived mirrors of both compromised sites, publicly documenting the scope of the breach. While no explicit motive was declared in the defacement, contextual evidence suggested the hacker’s opposition to perceived U.S. support for Turkish military actions against Kurdish territories. MuhmadEmad had prior affiliations with "Anonymous Kurdistan," a group known for targeting Turkish government websites with anti-ISIS messages. Both affected websites were fully restored and operational by August 4, 2015, when media reported the incident. No data theft, operational disruptions beyond website downtime, or additional collateral impacts were disclosed in available sources.