Hacktivists: attacked for what you say, not what you have

Who gets targeted

Most attackers choose targets by what they can take. Hacktivists choose by what you represent:

• Your industry: mining, energy, defence, animal products, forestry.
• Your clients or partners.
• Something you, or a staff member, said publicly.
• Where you are. Since the war in Ukraine began, hacktivist groups aligned with each side have attacked websites in countries that support the other, including government and company sites with no connection to the conflict.

Timing often follows the news: a protest, a court decision, an election, an anniversary.

How they attack

• Denial-of-service: flooding your website with traffic until it falls over. The tools are cheap and often rented.
• Defacement: replacing your home page with their message.
• Data leaks: taking whatever they can reach (customer lists, emails, internal documents) and publishing it.
• Doxxing: publishing personal details of staff or owners.
• Social media takeovers.

The attacks are usually not sophisticated, but they are loud, and the damage is reputational as much as technical.

Effort to defend: low to moderate

• Put your website behind a content delivery network with DDoS protection. For most sites this is cheap or free, and it absorbs the traffic floods.
• Keep the website and its plugins patched; most defacements use known holes.
• Separate your public website from your internal systems and data. A defaced brochure site is a bad day; a defaced site that is also the way into your email is a crisis.
• Don't store data you don't need, especially on the website.
• Protect social media accounts with MFA, and don't share logins.
• Have a tested way to restore the website from a clean copy.
• Decide in advance who speaks publicly if it happens. Arguing with hacktivists online tends to extend the attack.