Loading story…
Lizard Squad carried out a series of high-profile attacks against gaming platforms, knocking Sony's PlayStation Network and Microsoft's Xbox Live offline during major periods of user activity and extending outages that left players unable to access online services. The group was also linked to attacks on other gaming infrastructure, including Sony Online Entertainment and Blizzard Battle.net, using disruptive tactics that drew broad public attention and affected millions of users.
The campaign escalated beyond service disruption when the group posted a bomb threat on social media targeting a flight carrying Sony Online Entertainment president John Smedley, prompting American Airlines to divert the plane and bringing in an FBI response. Subsequent reporting said authorities arrested another alleged member while the group's own Lizard Lair service was hacked, underscoring mounting law-enforcement pressure and retaliation as the group's attacks and harassment tactics intensified.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Around the time of the January 2015 arrest, Lizard Squad's own Lizard Lair service was compromised. The incident represented a retaliatory or counter-hack against infrastructure associated with the group.
By January 2015, law enforcement had arrested another alleged member associated with Lizard Squad. The arrest marked an escalation from service disruptions and harassment into direct legal action against suspected participants.
Beginning on December 25, 2014, Lizard Squad claimed responsibility for outages affecting Sony's PlayStation Network and Microsoft's Xbox Live. The disruption left both gaming services inaccessible for many users during Christmas.
On August 24, 2014, a flight carrying Sony Online Entertainment President John Smedley was diverted to Phoenix after Lizard Squad publicly claimed there were explosives on board. Sony said the FBI was handling the incident and described it as a national security matter.
In August 2014, Lizard Squad launched DDoS attacks against major gaming services including Blizzard's Battle.net and Sony's PlayStation Network, causing service outages. The attacks were part of a broader campaign of disruption targeting gaming platforms and personalities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourcethenextweb.com
Open sourcebusinessinsider.com
Open sourceforbes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LulzSec carried out a short but highly visible campaign of intrusions and disruption against media, government, law-enforcement, and gaming targets, including **PBS**, **Sony Pictures**, the **U.S. Senate**, **InfraGard**, the **CIA** website, and the UK's **SOCA**. The group used website defacements, data theft, credential leaks, SQL injection, and distributed denial-of-service attacks, while amplifying its notoriety through Twitter, leaked data dumps, a public call-in line for target suggestions, and the broader **AntiSec** push alongside Anonymous. One early operation followed PBS reporting on WikiLeaks, and later leaked chat logs portrayed LulzSec as a small, publicity-driven but operationally cautious crew led by **Sabu**, with members such as **Topiary** and **Kayla**, amid internal strain and growing fear of retaliation. Law-enforcement pressure quickly escalated on both sides of the Atlantic. British police arrested and charged **Ryan Cleary** over alleged botnet and DDoS activity tied to attacks including SOCA, though LulzSec denied he was a core member, and later cases identified **Jake Davis**, **Ryan Ackroyd**, and others as participants or associates. In the U.S., authorities revealed that LulzSec leader **Hector Xavier Monsegur** (`Sabu`) had become an FBI informant after his arrest, helping investigators prevent hundreds of attacks and identify co-conspirators. The group announced it was disbanding after roughly 50 days, but prosecutions continued: multiple suspects were arrested in coordinated international operations, two British members later pleaded guilty, and subsequent court filings tied the campaign to substantial financial and operational damage across numerous victims.
Jun 29, 2026
The FBI escalated its investigation into **LulzSec** and affiliated **Anonymous** hackers by seizing server racks from a Reston, Virginia data center used by Swiss host DigitalOne, knocking multiple unrelated websites and services offline. According to reporting, agents were pursuing one customer but removed three equipment enclosures that may have held systems for many other clients, disrupting sites including **Curbed Network**, **Instapaper**, and **Pinboard** even though they were not identified as targets. U.S. officials said the operation was part of an active, broader inquiry supported by other agencies and international cybercrime partners. The enforcement push widened with arrests and searches tied to suspected members on both sides of the Atlantic. British authorities arrested a teenager on suspicion of hacking, while reports also described the arrest in London of a leading LulzSec figure and FBI raids on homes of suspected Anonymous participants in the United States, including a search in Hamilton, Ohio linked to the online alias `m_nerva`. Reporting said investigators drew on evidence connected to Ryan Cleary, who was charged under the UK Computer Misuse Act, as authorities worked to identify participants in the group after a string of high-profile intrusions and internal leaks exposed tensions inside LulzSec.
Jun 29, 2026
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026