Loading story…
Hacktivist group SiegedSec claimed it stole and leaked about 2GB of data tied to The Heritage Foundation, saying the operation was part of its #OpTransRights campaign and motivated by opposition to Project 2025. Reports said the exposed material included usernames, passwords or partial password data, email addresses, logs, comments, and IP address information, with SiegedSec asserting it had compromised a Heritage-linked server and published a ZIP archive of the data on Telegram before the public dump was later removed. The group framed the intrusion as retaliation against policies it said threatened abortion access and LGBTQ+ communities.
The Heritage Foundation disputed the breach claims, saying its core systems were not compromised and that the data came from a publicly accessible, two-year-old archive of The Daily Signal hosted by a contractor, affecting contributor and commenter records rather than internal Heritage systems. SiegedSec rejected that account and pointed to an allegedly hostile exchange involving Heritage Oversight Project executive director Mike Howell as evidence the organization was downplaying the incident. Shortly after publicizing the leak, SiegedSec announced it was disbanding, citing mental health strain, unwanted publicity, and concern about FBI attention.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
By July 12, 2024, reporting indicated that the public dump of the allegedly stolen Heritage Foundation data had been removed from public access. The takedown followed the group's leak and the ensuing dispute over what systems or data had actually been exposed.
Shortly after publicizing the alleged Heritage breach, SiegedSec said on Telegram that it was disbanding. Members cited mental health strain, publicity, and concern about FBI attention as reasons for ending the group.
On July 11, 2024, the Heritage Foundation disputed SiegedSec's claims, saying attackers did not breach its systems but instead accessed a publicly available two-year-old Daily Signal archive hosted by a contractor. Heritage said the exposed information was limited to contributor and commenter data, including usernames, names, email addresses, incomplete password data, comments, and commenter IP addresses.
By July 9, 2024, hacktivist group SiegedSec publicly claimed it had breached the Heritage Foundation as part of its #OpTransRights campaign and released roughly 2GB of allegedly stolen data. The group said the leak included usernames, passwords, logs, and other internal or user information tied to Heritage and The Daily Signal.
Salon reports that in April 2024, the Heritage Foundation attributed a separate cyberattack to nation-state hackers and said it had to shut down its network in response. This is described as an earlier incident preceding the July SiegedSec claims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetheverge.com
Open sourcesalon.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anonymous-affiliated attackers breached private intelligence firm **Stratfor**, stealing subscriber records, payment data, and a vast archive of internal correspondence. Reporting on the intrusion said the attackers accessed administrative systems, expanded into databases and mail servers, and exfiltrated data affecting about **860,000 user accounts** and more than **60,000 credit cards**; some reports said card numbers were stored in plaintext, while passwords were protected with weak **unsalted MD5** hashes. The attackers defaced Stratfor’s website, deleted server contents, published stolen card data, and used some of the payment information for fraudulent charitable donations, contributing to losses that reports put at at least **$700,000** and broader damages of roughly **$2 million**. The breach escalated when **WikiLeaks** began publishing roughly **5 million Stratfor emails**, exposing the firm’s client relationships, source-handling practices, monitoring of activist groups, and sensitive geopolitical claims contained in internal messages. Subsequent reporting said the FBI had visibility into parts of the operation through informant **Hector Xavier Monsegur ("Sabu")** and later built its case against alleged participant **Jeremy Hammond**, while Stratfor faced delayed customer notification and legal fallout. Years later, researchers also warned that some documents in the leaked Stratfor archive contained live malware, including files exploiting **`CVE-2010-3333`**, creating additional risk for journalists and researchers who downloaded the material.
Jun 29, 2026
Christian crowdfunding platform **GiveSendGo** suffered a breach that exposed donor information tied to the Canadian **Freedom Convoy 2022** fundraiser and related campaigns. Reporting said attackers took the site offline, redirected visitors to **GiveSendGone.wtf**, and leaked data on more than **92,000 donors**, including names and other personal details. VICE identified Aubrey Cottle, also known as **Kirtaner**, as publicly claiming responsibility for the intrusion, saying he targeted the platform over concerns about foreign political influence in convoy fundraising; reporting also said many donors were based in the United States, while Canadian donors contributed a larger share of the money. A subsequent leak reportedly expanded the exposure to roughly **5 GB** of internal data, including a **2.5 GB MySQL database dump**, **Bitbucket** source code, customer service records, and limited payment-card information such as card last-four digits and expiration dates. The disclosures intensified scrutiny of GiveSendGo’s security after earlier reports of exposed identity documents on its servers, an unresolved researcher warning dating back to 2018, and a separate 2021 donor-data leak linked to fundraising for people involved in the January 6 Capitol riot. GiveSendGo CEO Jacob Wells condemned the breach as illegal and said law enforcement was expected to investigate, while Cottle said he received death threats after claiming involvement.
Jun 29, 2026
Hargreaves Lansdown suffered customer-facing IT problems, including account-balance glitches and service outages, between September 2025 and May 2026, prompting customer concern that the investment platform had been hacked. The company said the incidents were technical issues and maintained there was no evidence of a cyber incident or data breach. In April 2026, the **Bashe** extortion group, also tracked as **APT73** and **Eraleign**, added Hargreaves Lansdown to its Tor leak site and claimed it had stolen a database of **658,259** unique users; a sample later appeared on DarkForums. Subsequent analysis found the records were likely recycled or fabricated, with selectively chosen UK entries and overlaps with older breaches including **Verifications.io** and **People Data Labs**, indicating the group used the firm's recent outages to make a false breach claim appear credible and increase reputational pressure.
Jul 12, 2026