Cyber Incident Victim: National Disaster Risk Reduction and Management Council
Date:
Jul 2016
Location:
Philippines
Summary
A Philippine government agency and numerous other state websites experienced disruptive DDoS attacks coinciding with an international ruling favoring the country in a maritime dispute with China. The attacks primarily targeted high-profile defense, foreign affairs, and disaster management entities alongside smaller municipal and non-sensitive portals, severely hindering government operations for two days. Subsequently, two defaced sites displayed messages attributed to the "Chinese government" but linked to an inactive Anonymous-associated Twitter account. While the source remained unconfirmed, officials suspected Chinese involvement due to the timing amid heightened bilateral tensions. The incident underscored cyber vulnerabilities during geopolitical crises, with local hacktivist groups also anticipated to retaliate against Chinese targets.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 12, 2016, coinciding with the Permanent Court of Arbitration's ruling favoring the Philippines in a maritime dispute with China over territorial claims in the West Philippine Sea, a series of distributed denial-of-service (DDoS) attacks targeted 68 Philippine government websites. The attacks commenced in the afternoon and persisted with consistent intensity through July 13, disrupting operations across multiple agencies. Among the primary targets was the National Disaster Risk Reduction and Management Council (NDRRMC), alongside other critical entities including the Department of National Defense, Department of Foreign Affairs, and Bangko Sentral ng Pilipinas. Smaller, non-sensitive portals such as the Komisyon sa Wikang Pilipino, Manila City Hall, and local government unit websites were also impacted. The sustained attacks severely hindered government functions, rendering some services temporarily inaccessible or significantly degraded during the two-day period.
By July 16, officials discovered two government websites had been defaced with a message attributed to the "Chinese government," though the linked Twitter account belonged to an inactive Anonymous member. While Philippine authorities acknowledged the defacements and DDoS disruptions, they did not conclusively attribute the attacks. The timing—immediately following the international tribunal's ruling against China’s territorial claims—led officials to suspect Chinese-linked actors, though no technical evidence confirmed this. The incident exacerbated existing diplomatic tensions between the two nations, described as nearing a state of conflict. Concurrently, the presence of active Philippine-based hacktivist groups like Anonymous and LulzSec suggested potential retaliatory cyber operations against Chinese infrastructure, though no such actions were documented in the immediate aftermath of the attacks.