Cyber Incident Victim: Richland County Ambulance Service
Date:
Nov 2015
Location:
United States of America
Summary
A pro-ISIS hacking group known as Team System DZ compromised three county government domains, defacing websites with messages supporting the Islamic State and playing Arabic audio. The attackers targeted Veterans Services, Emergency Management, and Recycling portals, displaying "Hacked By Team System Dz" banners and jihadist propaganda text. While no data breach was confirmed, the incident mirrored the group's previous website takeovers for other entities. All affected sites were restored to normal operation shortly after the attack. The Algerian-based hackers had prior history of similar pro-ISIS cyber intrusions against government and educational institutions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On November 28, 2015, pro-ISIS hacking group Team System DZ defaced three Richland County, Wisconsin government domains: the Veterans Services Office (veterans.co.richland.wi.us), Emergency Management (em.co.richland.wi.us), and Recycling (recycling.co.richland.wi.us) websites. The Algerian-based group replaced each site's content with a page displaying "Hacked By Team System Dz" at the top before 9 p.m. ET, accompanied by an Arabic-language audio song. The defacement included a written message supporting the Islamic State terrorist organization, stating "#Op USA | Ir | il | Ru | Fr | I love you Islamic State & Jihad Islamic State remain and expand, God willing, We will restore the dignity of Muslims Glory will return to Islam The dispute will return to outdated Be prepared." Team System DZ had previously targeted Richland County in March 2015 by hacking the Sheriff's Department website, and had also compromised the University of Toronto and Isle of Wight, Virginia websites with similar pro-ISIS content. Zone-H mirrors provided public evidence of all three defacements.
The attackers' access methods and whether they exfiltrated sensitive data remained unconfirmed at the time of reporting. All affected websites were fully restored and operational by the publication date of the incident report. This incident occurred amid ongoing cyber conflicts between pro- and anti-ISIS hacking groups, with groups like Anonymous frequently targeting pro-ISIS actors. Earlier that same week, Anonymous had compromised another pro-ISIS website, replacing its content with a viagra advertisement while urging supporters to "calm down." Richland County administrators had not publicly disclosed technical details about the breach vector or containment measures when initially contacted by media. No disruptions to county services or follow-up attacks were reported following the restoration.