Anatomy of a Breach

Anatomy of a Breach: LulzSec — 50 Days of Chaos from the NHS to the CIA

> series: anatomy_of_a_breach —— part: 030 —— attacker: lulzsec —— duration: 50_days —— targets: nhs_cia_sony_pbs_senate_soca<span class="cursor-blink">_</span>_

Hedgehog Security 30 June 2011 14 min read

Fifty days. The NHS. The CIA. Sony. 'We did it for the lulz.'

In May 2011, a group of six hackers — operating under the banner Lulz Security (LulzSec) — launched a 50-day campaign of attacks that targeted some of the most prominent organisations in the world. Their targets included Sony Pictures (1 million accounts leaked), PBS (website defaced with a fake story), the US Senate (server data published), the CIA (website taken offline via DDoS), the UK's NHS (patient data from a trust website accessed via SQL injection), and the Serious Organised Crime Agency (SOCA website DDoS'd offline). Between attacks, they published stolen data, taunted their victims on Twitter, and released press statements written with theatrical flair.

LulzSec's stated motivation was not political, financial, or ideological — it was entertainment. 'We do things just because we find it entertaining,' they declared. Yet their campaign exposed a devastating truth: the security of government agencies, healthcare organisations, media companies, and intelligence services was so weak that a small group of hackers could compromise them for fun, using techniques that were neither novel nor sophisticated. The NHS attack, in particular, demonstrated that UK patient data was accessible through basic SQL injection — the same vulnerability class that had enabled Gonzalez's 174-million-card theft years earlier.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

A timeline of targeted chaos.

LulzSec 50 Days — Selected Targets
── May 2011 ───────────────────────────────────────────────
Fox.com — database compromised, 73,000 X Factor contestants leaked
Sony Pictures — 1 million accounts with plaintext passwords
PBS — website defaced, fake news story published

── June 2011 ──────────────────────────────────────────────
NHS — UK patient data from trust website via SQL injection
US Senate — internal server data published
CIA — website taken offline via DDoS
SOCA (UK) — Serious Organised Crime Agency website DDoS'd
Sony (again) — further data leaks and DDoS
InfraGard (FBI affiliate) — database dumped
Bethesda Softworks / EVE Online / Minecraft — gaming sites

── 25 June 2011 ───────────────────────────────────────────
LulzSec announces '50 Days of Lulz' is over
Releases final data dump: AT&T internal data, others
Disbands (members later arrested and prosecuted)

The NHS and SOCA — UK security laid bare.

LulzSec's attacks on UK targets were particularly embarrassing. The NHS breach exploited a simple SQL injection vulnerability on a trust website to access patient-related data — demonstrating that UK healthcare infrastructure remained vulnerable to the most basic web application attacks. The SOCA website — the UK's primary law enforcement agency for serious organised crime — was taken offline by a DDoS attack, an ironic humiliation for the agency responsible for investigating cybercrime.

Both attacks underscored points we have made throughout this series: SQL injection is preventable through basic web application testing, and DDoS resilience requires proactive preparation, not reactive scrambling. For healthcare organisations and public sector bodies, the LulzSec campaign was a humiliating demonstration that their web-facing infrastructure had not been security tested.


Nothing new. That was the point.

SQL Injection — Still
LulzSec's primary attack method was SQL injection — the same vulnerability that has appeared in nearly every instalment of this series since Heartland in 2009. The NHS, Sony Pictures, InfraGard, and PBS were all compromised through SQL injection. Our <a href="/penetration-testing/web-application">web application testing</a> finds SQL injection in production systems routinely — because organisations routinely fail to test for it.
DDoS
The CIA and SOCA attacks were denial-of-service — overwhelming websites with traffic to take them offline. While DDoS does not steal data, it causes operational disruption and reputational damage. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses DDoS resilience.
Weak Password Storage
Sony Pictures stored 1 million passwords in plaintext. Not weak hashing — plaintext. LulzSec published the entire database, and the credential reuse implications were enormous. <a href="/cyber-essentials">Cyber Essentials</a> mandates appropriate authentication controls.
Publicity as a Weapon
LulzSec's Twitter account, press releases, and public data dumps were as damaging as the technical attacks themselves. The group understood that embarrassment is a powerful weapon — and that public disclosure of stolen data maximises reputational damage. <a href="https://www.socinabox.co.uk/blog/what-is-the-dark-web-business-guide">Dark web monitoring</a> through <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects when your data appears in public dumps or on criminal forums.

Arrests, convictions, and a lasting lesson.

LulzSec's members were eventually identified and arrested. The group's leader, Hector Monsegur (alias 'Sabu'), was an FBI informant who helped identify other members. UK members including Ryan Cleary and Jake Davis were prosecuted. But the damage was done — and the lesson endures: a handful of people using basic, well-known techniques can compromise organisations of any size if those organisations have not tested their defences.

Our penetration testing identifies the SQL injections, weak passwords, and missing DDoS protections that LulzSec exploited. Cyber Essentials establishes the baseline. SOC in a Box monitors for the attack patterns that precede hacktivist campaigns. And UK Cyber Defence provides incident response when an attack occurs. Because LulzSec proved that 'for the lulz' is as dangerous a motivation as any.


LulzSec used basic techniques against untested defences. Have yours been tested?

SQL injection. DDoS. Weak passwords. LulzSec hit the NHS, the CIA, and Sony with the same attacks we find in every penetration test. <a href="/penetration-testing">Test yours</a> before someone tests them for you.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles