Hacktivism is the use of hacking techniques to promote a political or social cause. Attacks are usually public and aimed at visibility, such as website defacement, denial of service and data leaks, rather than at quiet theft. Preparation is mostly good basics, plus a plan for disruption and public attention.
What do hacktivists want?
The goal is attention and pressure, not profit. A group picks targets that match a cause or a news event: a government body, a company accused of wrongdoing, a country's infrastructure. The attack is announced on social media or messaging channels, because the audience is part of the point.
That is different from criminal groups seeking money and from state backed teams seeking intelligence. In practice the boundaries blur, since claims of attack can be exaggerated, and some groups act for or alongside states. Treat claims as claims until your own logs confirm them.
What do hacktivist attacks usually look like?
ENISA, the EU cybersecurity agency, reported in November 2025 that EU public administrations were increasingly targeted by hacktivists, who primarily used distributed denial of service (DDoS) attacks. That fits the usual pattern: techniques that need little skill and give visible results.
Common methods include:
- DDoS, where large volumes of requests make a site slow or unreachable. The damage is usually temporary.
- Defacement, where a website's content is replaced, often through an old content management system or weak credentials.
- Data leaks, where stolen or exposed data is published. Sometimes the data is old, or taken from a third party.
- Account takeover of social media profiles for the organization.
- Attempts against exposed operational technology, such as internet reachable control panels with default passwords. These are rarer and need attention because of safety impact.
A constructed example
A city council publishes a planning decision that attracts anger online. Within a day, a group posts that it will "take the council offline". The council's website, hosted on a small server, slows during a burst of traffic and the contact form fails for three hours. Staff cannot tell whether data was touched. Because the council had a written plan, the communications lead posted a brief status note on another channel, the technical lead enabled the provider's traffic filtering, and logs showed no unauthorized logins. The group's claim of a "breach" was not supported by the evidence.
How should you prepare?
The UK NCSC publishes guidance to help organisations understand and mitigate denial of service attacks. Its themes are worth following: know your services, understand how they would degrade, and have scalable defences and a response plan ready before an attack.
Practical steps:
- Protect public sites. Put them behind a service that absorbs traffic spikes, and cache what you can.
- Keep content systems patched and remove unused plugins and old admin accounts.
- Use strong authentication on administrator and social media accounts.
- Find exposed devices. Scan your own address ranges for internet reachable management pages, especially for operational technology.
- Minimise sensitive data on public facing systems and third party platforms.
- Prepare a communications plan. Decide who speaks, where updates are posted and what you will say when facts are unclear.
- Watch for event triggers. If your organization is in the news or active in a controversial area, raise monitoring.
How to check or apply this
- Ask your hosting or network provider what DDoS protection you have and how to switch it on.
- Run a short tabletop: "Our website is down and a group has claimed a breach." Who does what in the first hour?
- Check logs for signs of real intrusion before accepting any claim.
- Keep an offline copy of your site so you can restore it after defacement.
- Report incidents to your national cyber centre or law enforcement as your jurisdiction advises.
Quick check
Is hacktivism illegal?
Breaking into or disrupting systems without permission is illegal in most places, whatever the motive.
Should we pay or negotiate with a hacktivist group?
There is usually nothing to pay for, since demands are political. Contact your legal team and the authorities before any reply.
Sources
- ENISA annual threat report 2025, with ENISA press release on hacktivist DDoS against EU public administrations (6 Nov 2025)
- UK NCSC, Denial of Service (DoS) guidance
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
Last reviewed: 18 October 2026.
