Managing Ideological Cyber Disruption Without Hype

An executive guide to the motives, methods, business effects and proportionate response to ideologically motivated cyber activity

Executive summary

Hacktivism is best understood as a spectrum of unauthorised digital activity undertaken, or presented, in support of a political, social or geopolitical cause. It ranges from short-lived website disruption and defacement to data theft, doxxing and attempts to interfere with operational technology. The label describes a claimed motive; it does not guarantee independence, technical sophistication or public-interest legitimacy.

For senior leaders, the central challenge is calibration: incident volume is not the same as business consequence. The European Union Agency for Cybersecurity analysed 4,875 incidents between 1 July 2024 and 30 June 2025 and reported that hacktivism accounted for almost 80% of recorded incidents, primarily through low-impact DDoS campaigns; only 2% of hacktivism incidents resulted in service disruption. DDoS accounted for 77% of all reported incidents. These figures show that high activity does not necessarily produce high impact, although repeated or well-timed disruption may still create a material operational burden for an individual organisation.

The right conclusion is neither that hacktivism is a digital apocalypse nor that it is mere noise. A technically simple attack can still stop citizens reaching a council website, disrupt a customer journey, consume scarce incident-response capacity and create a visible test of leadership. The UK’s National Cyber Security Centre warned in January 2026 that Russian-aligned groups continued to target local government and critical infrastructure. Its Director of National Resilience, Jonathon Ellison, stressed that denial-of-service attacks may be simple but can have significant effects by preventing access to essential services.

Boards should therefore treat hacktivism as an enterprise-resilience issue rather than a narrow security problem. The exposure sits at the intersection of technology, operations, communications, legal duties, public affairs, supply chains and employee safety. The most effective response combines sensible technical controls, clear decision rights, rehearsed communications, lawful intelligence collection and an honest understanding of why the organisation may become a symbolic target.

This article makes five arguments. First, attribution should be expressed with confidence levels, because public branding and state direction are not the same thing. Secondly, organisations should plan for the consequences that matter to people, not simply the number of packets or posts. Thirdly, data theft and doxxing demand a different response from a short DDoS event. Fourthly, AI is more likely to increase speed, volume and persuasion than to remove the need for access, infrastructure and human judgement. Finally, proportionality matters: overreaction can magnify an attacker’s message, while underreaction can leave customers, staff and the public carrying avoidable harm.

hacktivism future cybercrime cyber protest cyber warfare whistleblower

What has changed, and what has not

A movement, a brand and sometimes a proxy

Early public discussion often treated “hacktivists” as a single community. In practice, the term covers loose volunteer collectives, persistent groups with recognised brands, opportunists seeking attention, criminal actors borrowing a cause and state-aligned networks whose relationship with government may be indirect or deliberately obscured. A group may act independently, receive encouragement, share a geopolitical objective or operate as a deniable proxy. Those possibilities should not be collapsed into one claim.

The clearest current pattern in Europe is the use of accessible DDoS tools against visible targets associated with government policy, elections, international alliances or military support. ENISA’s 2025 Threat Landscape reported that NoName057(16) was responsible for more than 60% of claims in its assessed sample and associated peaks in activity with elections and geopolitical events. That is a measure of claimed activity, not proof that every claim was accurate or every target was materially disrupted.

Public claims can be an important part of a hacktivist campaign because they amplify visibility beyond the technical event. Treat screenshots, countdowns and declarations of success as claims to be verified rather than proof of disruption. The first internal brief should therefore separate observed facts, attacker assertions, unresolved questions and the organisation’s next actions.

Low barriers do not mean low risk

DDoS remains attractive because it is visible, repeatable and comparatively accessible, and it does not usually require penetration of the target’s internal network. Joint US guidance from CISA, the FBI and MS-ISAC distinguishes volumetric attacks that consume bandwidth, protocol attacks that exhaust network or intermediary resources, and application-layer attacks that overwhelm a specific service. Mitigation varies by attack type and may require coordination with internet service providers, content-delivery networks or specialist DDoS protection services.

The operational impact depends on architecture and context. An attack against a well-protected public website may cause little more than alert noise. The same traffic directed at a fragile authentication service, booking platform or citizen portal can block access at a politically sensitive moment. A brief outage can also trigger longer disruption when teams disable services, change routing or take systems offline while they investigate. The business loss may therefore arise as much from uncertainty and recovery activity as from the attack traffic.

The boundary with intrusion, crime and espionage

Some groups move beyond disruption into credential theft, data exfiltration, extortion or manipulation of internet-connected industrial systems. At that point, the practical response becomes closer to a conventional breach or hostile-state incident. The motive may remain ideological, but the consequences to individuals and the organisation are governed by the data taken, the systems changed and the services affected.

A December 2025 international advisory, published by CISA and jointly authored with the FBI, NSA, UK NCSC, Europol, Eurojust and other national partners, assessed that pro-Russian hacktivists were conducting opportunistic attacks against operational technology and critical infrastructure. Its priority mitigations were to reduce public internet exposure of operational-technology assets, maintain mature asset-management processes including maps of data flows and access points, and enforce robust authentication. The executive lesson is that these actors often exploit exposed or weakly protected systems rather than relying on novel vulnerabilities.

Leaders should avoid a false choice between “hacktivism” and “serious cyber attack”. The same incident can begin with symbolic disruption and reveal a deeper compromise; conversely, a noisy claim may mask very limited capability. Incident classification should follow evidence and business consequence, not the attacker’s self-description.

Recent cases and what they teach

NoName057(16): scale through participation and automation

NoName057(16) illustrates how a recognisable cause, a messaging channel and a shared tool can turn many modest participants into a persistent campaign. The NCSC says the group has been active since March 2022, used Telegram to coordinate supporters and distributed its DDoSia tool through online repositories. It has repeatedly targeted public- and private-sector bodies in NATO and European countries perceived as hostile to Russian interests, including UK local government.

In July 2025, Europol and Eurojust coordinated Operation Eastwood with authorities from numerous European countries and the United States. The action disrupted attack infrastructure consisting of more than 100 computer systems, took a major part of the group’s central server infrastructure offline, and was accompanied by seven arrest warrants and direct warnings to several hundred suspected supporters. Europol described the participants as mainly Russian-speaking sympathisers who used automated tools, operated without formal leadership or sophisticated technical skills, and were motivated by ideology and rewards.

For executives, the lesson is twofold. First, persistent low-level pressure can be organised without a conventional hierarchy. Secondly, enforcement can remove infrastructure and expose participants to investigation, but the published results do not establish how long the disruption lasted or whether the network permanently lost capacity. Resilience therefore cannot depend on the arrest of a leader or the removal of one server.

Essential services: the harm is experienced by people

The NCSC’s January 2026 warning focused particularly on local government and operators of critical national infrastructure, noting that successful denial-of-service attacks can prevent people from accessing essential services and can cost organisations significant time and money to analyse, defend against and recover from. In practice, disruption may also displace demand to contact centres, increase pressure on employees and suppliers, and require leaders to communicate before every fact is known.

This is where a balanced assessment matters. ENISA’s finding that only 2% of hacktivist incidents in its 2025 dataset caused service disruption should prevent inflated language. Its finding that public administration was the most targeted sector, and that low-impact DDoS dominated those events, should prevent complacency. Frequent, modest attacks can still become operationally significant for organisations with thin teams, ageing platforms or limited ability to buy upstream protection.

Operational technology: modest access can create disproportionate concern

Internet-exposed operational technology deserves special attention because even a limited change can affect safety, physical processes or public confidence. The joint 2025 advisory on pro-Russian activity did not describe a uniformly sophisticated adversary. It warned about opportunistic targeting of exposed systems, weak authentication and poor asset management. That distinction is reassuring and demanding at the same time: the threat is often containable, but only if owners know what is connected and remove avoidable exposure.

Senior leaders should ask whether remote maintenance paths are inventoried, whether suppliers use individual and strongly authenticated accounts, whether engineering workstations and controllers are monitored, and whether operations can continue safely if remote access is suspended. These are governance questions as much as engineering questions because they involve cost, contracts, service availability and risk acceptance.

Information operations can amplify technical events

Technical disruption increasingly sits beside manipulated narratives. NATO’s approach to countering information threatsnotes that state and non-state actors use coordinated and manipulative activity to affect public opinion, and that AI and deepfakes can amplify confusion and undermine trust. This does not mean every hacktivist campaign is an AI-enabled influence operation. It means leaders should be prepared to verify edited images, false claims or impersonation if they appear alongside a technical event.

The practical response is not to label criticism as disinformation. Organisations need a disciplined evidence process, rapid correction of demonstrably false operational claims and continued respect for legitimate protest, journalism and public scrutiny. When businesses appear to dismiss a grievance simply because an unlawful actor has adopted it, they can alienate employees, customers and communities who share the concern but reject the method.

State influence operations and democratic resilience

From election hacking to persistent manipulation

Nation-state activity directed at democratic debate is broader than interference with voting systems. The US Department of Justice Office of the Inspector General defines foreign malign influence as subversive, covert or undeclared, coercive or criminal activity by foreign governments, non-state actors or their proxies to sow division, weaken democratic processes or steer policy towards the foreign actor’s objectives. Influence may involve authentic but selectively presented material, fabricated stories, covert funding, impersonation, hacked-and-leaked information, proxy media and networks of inauthentic accounts. Interference is a narrower category that can include cyber operations against campaigns, election authorities or infrastructure.

The distinction matters. A government may seek to intensify existing arguments rather than invent an ideology or grievance. Content can promote opposing extremes at the same time if the strategic purpose is polarisation, distrust or paralysis. Democratic disagreement is not itself evidence of foreign direction, and unpopular or extreme views should not be labelled foreign propaganda without evidence. The defensible focus is on concealed sponsorship, coordinated inauthentic behaviour, unlawful access and independently verified attribution.

The scale and diversity of the threat have grown. In July 2024, the US Office of the Director of National Intelligenceassessed that a “diverse, growing, and more capable” group of foreign actors was seeking, or was likely to seek, influence over the November election. Its principal concerns were Russia, Iran and China, although their objectives and levels of activity differed. This is not evidence that foreign activity determines electoral outcomes. It is evidence of sustained investment in shaping the information environment around elections.

2016 US presidential election

The 2016 US election established the modern pattern. The bipartisan US Senate Select Committee on Intelligence investigation documented Russian active measures, including cyber operations and the use of social media. Its volume on Russia’s use of social media described activity by the Kremlin-backed Internet Research Agency that impersonated Americans, targeted political and social divisions and sought to influence political dialogue. The committee’s public account emphasised that the broader objective included sowing discord and eroding confidence in democratic institutions, not simply supporting one electoral result.

A January 2017 US Intelligence Community Assessment concluded that Russia conducted an influence campaign that combined covert intelligence activity, cyber operations, state-funded media and paid online participants. The assessment did not say that vote tallies were changed. That boundary remains important: evidence of a substantial influence campaign is not the same as proof that it altered the result, and intelligence assessments should be presented with their stated confidence and scope.

The 2016 EU referendum

The UK evidence is less conclusive and should be described accordingly. The Intelligence and Security Committee of Parliament’s Russia report, published in 2020, said there was credible open-source commentary suggesting that Russia undertook influence campaigns relating to the Scottish independence referendum and potentially the 2016 referendum on EU membership. However, the Committee found that the UK Government had not sought or conducted a comprehensive retrospective assessment of possible Russian interference in the EU referendum. It therefore did not establish that such interference occurred or affected the result.

The Committee’s central criticism was institutional rather than electoral: protection of democratic processes lacked clear ownership, and the absence of an assessment left an evidential gap. The Government response rejected the need for a retrospective assessment and stated that it had seen no evidence of successful interference. These positions are not identical. A balanced account should neither claim that Russian interference determined the referendum nor convert the lack of a full assessment into proof that no activity occurred.

2020 US presidential election

For the 2020 election, the US Intelligence Community assessed that Russia and Iran conducted influence operations, while China considered but did not deploy an election-influence effort intended to change the presidential outcome. The assessment said that Russian actors promoted misleading or unsubstantiated allegations, used proxies linked to Russian intelligence and sought to undermine public confidence. It assessed that Iran carried out a multi-pronged covert campaign intended to undercut the incumbent president’s prospects and damage confidence in the electoral process.

The same assessment found no indications that any foreign actor attempted to alter technical aspects of the voting process, including voter registration, ballot casting, vote tabulation or reporting of results. It expressly did not assess the effect of foreign activity on the election outcome. This separation between intent, activity, technical compromise and measurable electoral impact is essential for accurate executive and public communication.

2024 US presidential election

By 2024, foreign activity was more varied and faster. US intelligence updates identified Russia as the most active election-influence threat, assessed that Iran was conducting influence and cyber operations, and described China as concentrating more on down-ballot contests and broader political influence than on the presidential result. An October update warned that Russia, Iran and China were seeking to amplify divisive narratives, while noting differences in their preferred outcomes and methods. A joint ODNI, FBI and CISA statement on the eve of the election said Russian-linked actors were manufacturing videos and fake articles intended to undermine confidence and intensify division.

The campaign also illustrated the interaction between cyber intrusion and information operations. In August 2024, ODNI, the FBI and CISA attributed attempts to compromise presidential campaigns to Iran; a later statement said Iranian actors sent stolen, non-public campaign material to people associated with another campaign and to US media organisations. Separately, the US Department of Justice disrupted the Russian government-directed “Doppelganger” operation, alleging that it used deceptive domains, paid advertising, influencers and AI-assisted content to influence US and foreign audiences, including voters in the 2024 presidential election.

Generative AI made some content quicker and cheaper to produce, but public US assessments did not conclude that it transformed the fundamentals of influence operations. A September ODNI election-security update said AI was improving and accelerating aspects of foreign activity but had not revolutionised it. Distribution, credibility, timing, covert sponsorship and exploitation of genuine social divisions remained decisive.

Implications for executives

Election influence is not solely a government or social-media problem. Businesses, universities, charities, news organisations and critical-service providers can be used as narrative targets, unwitting distribution channels or sources of stolen material. An organisation may face a forged statement, a spoofed news page, the theft and selective release of internal documents, impersonation of an executive or claims that its systems affected an election.

Preparedness should protect democratic debate rather than police opinion. Leaders should establish how they will authenticate official communications, detect impersonation, preserve evidence, verify leaked material and coordinate with public authorities and platforms. They should distinguish a false claim from a contentious but legitimate viewpoint, and disclose uncertainty rather than speculate about attribution. The objective is not to arbitrate political truth; it is to make concealed foreign sponsorship, technical manipulation and demonstrably false operational claims harder to exploit.

Algorithms and hacktivism: who gets seen, and who does not

Ranking systems are not neutral distribution pipes

Social-media feeds do not normally show every available post in chronological order. Recommender systems predict which material a user is most likely to watch, share, comment on or otherwise engage with, then rank a small selection accordingly. They can help people discover relevant information and enable small campaign groups to reach supporters without traditional media access. The same systems can also change the relative visibility of political narratives with exceptional speed.

Visibility is shaped by several layers: the accounts a person follows; paid targeting; recommendations based on previous behaviour; trending and search systems; platform rules; and moderation or downranking decisions. “Promotion” can therefore mean paid delivery to a selected audience, preferential ranking by an engagement model, or coordinated users generating signals that cause a topic to trend. “Suppression” can mean removal, account suspension, demonetisation, reduced recommendation, lower search ranking or displacement by more highly ranked content. These mechanisms have different legal and evidential implications and should not be treated as interchangeable.

Ofcom’s research on recommender systems explains that ranking choices can increase or decrease the likelihood that users encounter illegal or harmful material. The European Centre for Algorithmic Transparency similarly notes that algorithms shape recommendations, advertising and moderation, and can contribute to risks including radicalisation and harm to civic discourse and electoral processes. Neither finding proves political intent by a platform. It establishes that design choices influence exposure and require systematic evaluation.

How activists and hostile actors exploit the system

Hacktivist and influence campaigns do not need access to a platform’s source code to exploit its incentives. They can coordinate posting schedules, repeat slogans and links, use emotionally charged imagery, recruit accounts with large followings, purchase targeted advertising, operate networks of authentic or inauthentic accounts, and move supporters from private channels to public platforms at an agreed time. These tactics seek to create the engagement and velocity that ranking systems interpret as relevance.

The incentive is important because antagonistic content can perform unusually well. A peer-reviewed analysis of more than 2.7 million posts from US news organisations and members of Congress found that posts referring to a political out-group were shared or retweeted about twice as often as posts referring to the in-group. Each out-group term increased the odds of sharing by 67%, and out-group language was a stronger predictor of engagement than negative or moral-emotional language. The authors of the PNAS study described this as a potential perverse incentive for content expressing political animosity. The result concerns observed engagement, not proof that every platform intentionally promotes hostility.

Coordinated actors can also buy precision. Advertising systems permit segmentation by location, interests, inferred preferences and previous engagement, subject to platform rules and law. A campaign can test multiple messages, direct different claims to different audiences and make public scrutiny difficult when each group sees a different advert. Organic recommendation adds a second route: once a message generates engagement, it may reach users who never followed the originating account. Hack-and-leak operations can exploit both routes by pairing selectively released material with targeted promotion and networks that manufacture apparent public momentum.

Cambridge Analytica: targeting at scale without proof of electoral effect

The Cambridge Analytica scandal remains the clearest warning about the combination of personal data, political profiling and targeted distribution. The US Federal Trade Commission alleged that an app developer, Cambridge Analytica and its former chief executive used deceptive practices to collect personal information from tens of millions of Facebook users. Data gathered through the GSRApp, sometimes called “thisisyourdigitallife”, included information from app users and people in their Facebook networks. The original application and its developer are defunct, and no verified official homepage remains, so the FTC case page is retained as the authoritative public record. The FTC said the data were used to train an algorithm that generated personality scores, which were then matched with US voter records for voter profiling and targeted advertising.

The case is often described too loosely. Cambridge Analytica did not control Facebook’s news-feed algorithm, and the enforcement findings do not establish that psychographic targeting changed the result of the 2016 US presidential election or the 2016 UK referendum. The demonstrated failure was more fundamental: data collected under misleading representations could be repurposed to infer characteristics, segment voters and deliver political messages to narrowly defined audiences with limited public visibility.

The UK Information Commissioner’s Office investigation found that political organisations were using detailed personal information to target small groups of voters with specific adverts. In the United States, the FTC ultimately ordered Cambridge Analytica to delete data and work products derived from the deceptively obtained information. In a separate but related 2019 settlement, Facebook agreed to a US$5 billion FTC penalty and extensive privacy-governance requirements for violating a 2012 privacy order. The penalty was not a judicial finding that Facebook caused a particular electoral outcome; it addressed deception, user control and failures in privacy governance.

The executive lesson is that targeting power comes from the entire chain: data collection, inferred attributes, audience segmentation, message testing, advertising delivery and measurement. A platform can apply the same optimisation machinery to commercial and political campaigns even when the advertiser never sees the underlying source code. Governance must therefore examine provenance, lawful basis, inference, targeting criteria, advertiser identity and the records needed for later scrutiny.

Evidence of unequal amplification

Research demonstrates that algorithmic ranking can amplify political content unevenly, although results differ by platform, period and methodology. A large, randomised experiment conducted by Twitter researchers compared its personalised home timeline with a reverse-chronological feed across nearly two million daily active accounts. The published PNAS study found that elected politicians from the mainstream political right received greater algorithmic amplification than those from the mainstream left in six of seven countries studied, and that right-leaning US news sources were also amplified more. The researchers did not find evidence that far-left or far-right groups were systematically amplified more than moderates.

Facebook evidence from the 2020 US election also shows that curation changes exposure. A Science analysis of 208 million US users found high ideological segregation in political news consumption and reported that segregation increased from the content potentially available to users, to what appeared in feeds, to what users engaged with. Both algorithmic ranking and users’ social choices contributed. This is not evidence that a platform selected an electoral winner; it shows that supply, ranking, networks and individual behaviour combine to produce unequal attention.

YouTube audits likewise support a qualified account. A peer-reviewed PNAS audit using 100,000 automated test accounts found that the recommendation system offered ideologically congenial content to partisan users, with greater congeniality deeper in viewing trails for right-leaning users. It did not find a meaningful general increase in ideological extremity deeper in those trails. Recommendations from channels classified by the researchers as problematic increased, but remained a small proportion of all recommendations. Claims that recommendation systems invariably drive every user towards extremism therefore go beyond the evidence.

Reduced visibility and claims of suppression

Algorithms necessarily suppress some material in the ordinary sense that ranking one item higher pushes another lower. Platforms also deliberately reduce distribution of content assessed as spam, coordinated manipulation, harmful material or a breach of rules. During elections or crises, they may change ranking and moderation systems to reduce virality or promote authoritative information. The European Commission’s election-integrity guidance recommends that major platforms adapt recommender systems to empower users and reduce the monetisation and virality of content that threatens electoral integrity, while safeguarding freedom of expression.

That does not justify assuming that every fall in reach is politically motivated censorship. Reach can decline because of audience behaviour, competition, freshness, format, enforcement, model changes or measurement error. Conversely, a platform statement that its rules are viewpoint-neutral does not prove that outcomes are neutral. Credible assessment requires data on impressions, recommendations, moderation decisions, advertising delivery and appeals, ideally tested by independent researchers.

The empirical record is mixed. A large field experiment involving 23,377 US Facebook users during the 2020 election found that reducing exposure to like-minded sources changed what people saw, including reducing exposure to misinformation and uncivil content, but did not measurably change political attitudes over the study period. The Nature study cautions against treating short-term feed changes as a simple cure for polarisation. A Royal Society literature review similarly concluded that most people have comparatively diverse media diets, that politically partisan echo chambers contain a minority of users, and that self-selection as well as algorithms matters. These findings argue against both technological fatalism and complacency.

Regulation is moving from content to system design

Regulators increasingly focus on how platforms assess and mitigate systemic risk rather than directing the removal of lawful political views. Under the EU Digital Services Act, very large platforms and search engines must assess risks to civic discourse, electoral processes and fundamental rights. Users must also have access to a recommender option that is not based on profiling. The European Commission’s 2024 election guidelines recommend greater transparency, user control, protections around political advertising and post-election review.

Enforcement remains evidence-led. In December 2024, the European Commission opened formal proceedings concerning TikTok after the Romanian presidential election, including scrutiny of risks linked to recommender systems, coordinated inauthentic manipulation and paid political content. Opening proceedings was not a finding of infringement, and the Commission explicitly said the investigation did not prejudice its outcome. The case nevertheless shows that algorithmic distribution is now treated as part of election security.

In the UK, the House of Commons Science, Innovation and Technology Committee concluded in 2025 that recommendation algorithms and advertising-based business models can amplify misleading and harmful content. The Government and Ofcom response accepted the importance of platform accountability, user control, transparency and freedom of expression, while setting out regulatory and media-literacy measures. Ofcom’s own research stresses repeatable evaluation of recommender systems rather than reliance on one-off tests.

Enforcement is reaching data use and product design

Recent cases show that regulators and courts are moving beyond individual content decisions towards the data and design systems that determine who sees what. In January 2023, Ireland’s Data Protection Commission fined Meta Ireland €210 million for Facebook and €180 million for Instagram. The decisions concerned the lawfulness and transparency of personal-data processing for personalised services and behavioural advertising. The European Data Protection Board concluded that Meta could not treat behavioural advertising as necessary to perform its contract with users and instructed that the processing be brought into compliance. These were privacy decisions, not findings that Meta had promoted a particular political viewpoint.

The wider enforcement record is also relevant to the data infrastructure behind targeting. In May 2023, the Irish DPC imposed a €1.2 billion fine and corrective orders concerning Meta’s transfers of Facebook user data from the EU and EEA to the United States. In December 2024, it imposed €251 million in fines following a Facebook data breach, including findings on data protection by design and by default. These cases did not concern hacktivist narratives directly, but they demonstrate that large-scale personalisation depends on data governance that is increasingly subject to substantial penalties and structural orders.

Digital Services Act proceedings address a different layer. The European Commission opened formal proceedings against Facebook and Instagram in April 2024 concerning deceptive advertising, disinformation, political-content visibility, researcher access and user redress. In October 2025, it issued preliminary findings on researcher access, reporting mechanisms and appeals. Preliminary findings are not fines or final determinations. This distinction matters because headlines can otherwise make an allegation, an interim assessment and a concluded infringement appear equivalent.

New Mexico provides a recent example of product-design accountability in a US court. In March 2026, a jury found Meta liable under the state’s Unfair Practices Act and imposed US$375 million in civil penalties for misleading consumers about platform safety. In August 2026, the court added a US$567 million judgment and five years of court-supervised reforms, bringing the total ordered financial exposure in that proceeding to US$942 million. The judgment addressed product design, corporate representations and protections for younger users; it was not an election-interference case.

The New Mexico orders are nevertheless relevant to algorithms because they treat engagement-oriented product choices as governable design decisions rather than inevitable features of social media. The court required operational changes including stronger age assurance, default protections, overnight notification limits and time-use controls. Those remedies illustrate a broader shift: authorities are increasingly testing whether recommendation, notification and engagement systems were designed, assessed and explained responsibly.

Executives should read these cases with precision. A large fine does not prove partisan bias, intentional suppression or electoral causation. It does show that claims about consent, safety, transparency and system design can create legal exposure at platform scale. Organisations buying political or issue advertising, supplying audience data or relying on platform analytics should be able to explain what data were used, what inferences were made, how audiences were selected, what optimisation objective was applied and how affected people can challenge an error.

Implications for executives and campaign leaders

Organisations should assume that the public information environment is ranked, personalised and contested. A minority campaign may appear dominant to one audience and invisible to another. Trending status is not a reliable measure of public opinion, and raw engagement does not establish authenticity. During an incident, leaders should compare online signals with service data, media enquiries, customer contacts and trusted threat intelligence before changing strategy.

Monitoring should focus on behaviour and impact rather than ideology. Useful indicators include sudden coordinated posting, repeated assets across unrelated accounts, deceptive domains, abnormal referral traffic, impersonation, political advertising libraries and the rapid movement of a narrative between platforms. Organisations should record the evidence underlying any claim of manipulation and avoid describing lawful advocacy as inauthentic merely because it is effective or unwelcome.

Platform escalation plans should identify the evidence required to report impersonation, coordinated manipulation, doxxing or hacked material. Communications teams should publish verifiable source material in accessible formats, maintain authenticated channels and correct false operational claims without repeating inflammatory framing. Where reach falls, teams should test ordinary explanations before alleging suppression; where hostile narratives surge, they should test authenticity before treating volume as public consensus.

The governance question is not whether algorithms are good or bad. It is whether their objectives, data, safeguards and effects can be examined. Executives should support independent research access, transparent political advertising archives, meaningful user choice, clear reasons for moderation decisions and workable appeals. These measures do not guarantee neutrality, but they make hidden manipulation, arbitrary suppression and unsupported claims about both harder to sustain.

Why the wider business should care

Availability, trust and the cost of attention

A DDoS incident is often described as an availability problem, but its wider cost is the diversion of attention. Security teams investigate whether the event is a smokescreen. Digital teams protect customer journeys. Communications teams prepare statements. Legal and privacy specialists assess whether personal data is involved. Senior leaders field questions from regulators, clients and the board. Even when the website returns quickly, the organisation may spend days establishing confidence that nothing else happened.

The executive objective should be continuity of important outcomes, not mere survival of a particular server. If the main website fails, can customers still reach urgent information? If online booking is unavailable, is there a prioritised manual route? If a supplier absorbs the traffic, are escalation contacts and commercial limits understood? Mapping essential services to their digital dependencies turns a generic cyber scenario into a business-continuity decision.

People can become the target

Doxxing and data leakage can expose staff, customers, volunteers or public officials to fraud, intimidation and unwanted contact. The Information Commissioner’s Office defines a personal-data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Organisations must assess the likely risk to individuals’ rights and freedoms, notify the ICO without undue delay and, where feasible, within 72 hours when that reporting threshold is met, and inform affected individuals without undue delay when the breach is likely to create a high risk.

A humane response starts with those affected. People need plain information about what is known, what data was involved, what practical steps they can take and where to obtain help. A legalistic notice that minimises concern may meet neither the organisation’s ethical duty nor its long-term interest. Equally, premature certainty can cause needless alarm. Communications should state the scope of evidence, recognise uncertainty and commit to updates.

Leaders should also consider the burden on frontline teams. Employees whose names appear in hostile channels may need security advice, time away from public-facing duties or support for family concerns. An incident plan that focuses only on systems can miss the most serious human consequences.

Reputation is shaped before, during and after the event

Hacktivists select targets for symbolic value. An organisation may be targeted because it is prominent, supplies government, operates in a contested sector or is associated, accurately or not, with a controversial decision. Security controls cannot remove that symbolism. Public-affairs awareness, stakeholder listening and clear organisational values therefore form part of preparedness.

This does not mean conceding to unlawful pressure. It means understanding the narrative environment early enough to communicate with precision. Leaders should know which claims can be answered with verifiable facts, which concern legitimate policy disagreement and which should not be amplified. Where the organisation made a mistake, candour is usually safer than reflexive denial. Where a claim is false, evidence should be published in a form that customers, journalists and employees can understand.

Third parties can determine the outcome

Public websites, identity platforms, payment gateways, content-delivery networks, managed-service providers and communications agencies may all be involved in response. ENISA Executive Director Juhan Lepassaar has emphasised that interconnected services can create ripple effects across supply chains. Contracts should therefore cover DDoS capacity, incident notification, evidence preservation, out-of-hours contacts, communications approval and recovery objectives.

Boards should test concentration risk rather than assuming “cloud” means resilient. A service may have robust infrastructure but still depend on one identity provider, domain registrar or administrative account. Suppliers should be included in exercises and asked to demonstrate how they would respond when the customer becomes a politically visible target.

Law, ethics and the danger of easy labels

Political motive does not create legal authorisation

In the UK, section 1 of the Computer Misuse Act 1990 makes it an offence knowingly to secure unauthorised access to computer material. Section 3 addresses unauthorised acts intended to impair a computer’s operation, or undertaken recklessly as to whether they will do so, while section 3ZA addresses unauthorised acts causing, or creating a significant risk of, serious damage. A political or moral motive does not itself provide authorisation.

The UK Government has reviewed aspects of the Computer Misuse Act, including investigative powers and proposals raised by respondents concerning statutory defences. The Home Office’s analysis of consultation responses, published on 14 November 2023, recorded defences as an area for further consideration; it did not create a legal exemption for so-called non-destructive hacktivism. Debates about security research, vulnerability disclosure and journalism remain important, but they do not amount to a general authorisation for unauthorised access or denial-of-service activity.

This distinction protects both security and democratic debate. Legitimate digital activism includes campaigning, research, public-interest reporting, petitions, boycotts and lawful protest. Whistleblowing is governed by specific legal and organisational frameworks. Treating all dissent as a cyber threat is corrosive; treating all unauthorised interference as protest ignores the rights of victims and the rule of law.

Attribution should be careful, not theatrical

Attribution combines technical, behavioural, contextual and intelligence judgements. A familiar tool, language or target list may support an assessment but rarely proves who directed an operation. Some groups align themselves with a state’s objectives without being under day-to-day control; others may be encouraged, tolerated or resourced in ways that remain opaque.

Executives should use language such as “the activity is consistent with”, “the group claimed responsibility” or “government agencies assess” unless stronger evidence is available. Public accusation can have diplomatic, legal and commercial consequences. It can also distract response teams from the immediate task of restoring service and protecting people.

Response must remain proportionate

Proportionate response is not passivity. It means matching action to evidence, consequence and legal authority. Removing malicious infrastructure, preserving evidence, reporting crime and cooperating with national authorities can be justified. Monitoring public channels for threats can be legitimate when carried out lawfully. Infiltrating groups, collecting excessive personal data or retaliating against systems creates legal and ethical risk and should not be improvised by a victim organisation.

Law-enforcement cooperation can be effective when it is international and sustained. Europol’s Joint Cybercrime Action Taskforce exists to coordinate cross-border investigations, while Operation Eastwood demonstrated how public authorities and private technical organisations can combine infrastructure disruption, warrants and direct warnings. Businesses add value by keeping reliable logs, preserving evidence and reporting promptly rather than attempting their own counter-attack.

Regulation raises the baseline but does not replace judgement

Commission Implementing Regulation (EU) 2024/2690 specifies technical and methodological cybersecurity risk-management requirements and significant-incident criteria for defined categories of digital and trust-service providers covered by NIS2. Regulation (EU) 2024/2847, the Cyber Resilience Act, establishes lifecycle cybersecurity and vulnerability-handling obligations for products with digital elements and the economic operators responsible for them. These measures can raise the regulatory baseline, but compliance alone does not determine whether a politically sensitive service is sufficiently resilient.

Executives should treat regulation as a floor and connect it to operational reality: which services matter, who can stop or reroute them, how quickly customers can receive accurate information and who accepts residual risk. A completed control register is not the same as a rehearsed response.

A proportionate executive response

1. Define the services and harms that matter

Begin with business outcomes. Identify the digital services whose loss would affect safety, essential operations, vulnerable people, regulatory obligations or public confidence. For each service, document its owners, external dependencies, fallback arrangements and maximum tolerable disruption. Include communications channels: an organisation that cannot publish trusted updates during an attack has lost part of its response capability.

Use scenarios that combine events rather than testing a single control. A realistic exercise might pair a DDoS attack with a false claim of data theft, hostile contact with employees and a supplier outage. Executives then have to decide what to say, whether to invoke continuity plans, who contacts authorities and what evidence would justify changing the incident classification.

2. Reduce avoidable exposure

Implement the fundamentals before purchasing specialist tooling. Maintain an accurate inventory of internet-facing assets; remove unused services; patch known vulnerabilities; protect administrative access with phishing-resistant multi-factor authentication where practical; and separate operational technology from public networks. These measures align with the international advisory on pro-Russian hacktivist activity and reduce opportunities for actors who scan widely for weak targets.

For availability, establish capacity and mitigation with upstream providers. Understand whether protection covers network, protocol and application attacks; how quickly it activates; what happens when limits are exceeded; and who can authorise emergency routing changes. Test the process. A contract is not a control until the escalation path works at 2 a.m.

3. Build intelligence around decisions, not curiosity

Threat intelligence should answer operational questions: Is the organisation named? Are credentials or documents being offered? Is a specific date or service mentioned? Does observed traffic match the claim? What action would change because of this information?

Monitor lawful, relevant public sources and trusted information-sharing communities. Do not ask staff to enter hostile forums without appropriate tools, training, legal review and personal-safety safeguards. Collection should be necessary, proportionate and retained only as long as required. The purpose is early warning and evidence, not surveillance of lawful critics.

4. Establish decision rights before the incident

Agree who declares a major incident, who can suspend a public service, who approves customer communications and who contacts the NCSC, law enforcement, regulators and insurers. Give technical leaders authority to take protective action within defined limits, while reserving decisions with wider societal or financial consequences for executives.

Keep the board’s role strategic. Directors should challenge whether management understands exposure, has tested dependencies and can support affected people. They should not direct packet-level response. During an incident, a short dashboard should cover service impact, people affected, evidence of intrusion, decision points, legal notifications, communications and recovery confidence.

5. Communicate without becoming part of the campaign

Use a simple rhythm: confirm the service impact; state what is being done; provide an alternative route; distinguish confirmed facts from attacker claims; and commit to the next update. Avoid repeating slogans, linking to hostile channels or speculating about attribution. If personal data may be involved, coordinate public messaging with the privacy assessment but do not allow legal caution to produce silence.

Prepare messages for different audiences. Customers need practical alternatives. Employees need instructions and reassurance about personal risk. Partners need technical coordination. Regulators and authorities need timely facts. Journalists need a credible point of contact. Consistency matters, but identical wording does not meet every audience’s needs.

6. Recover in a way that strengthens trust

Recovery is not complete when traffic returns to normal. Verify that no related intrusion occurred, review logs and supplier actions, close exposed services, support affected individuals and update risk decisions. Preserve a clear chronology of observations and decisions.

Publish a proportionate account when public interest or stakeholder impact justifies it. Explain what happened, what did not happen, how people were affected and what will change. Avoid declaring victory over an adversary. Accountability is more durable than bravado, and it gives employees and customers a reason to trust the organisation after a difficult event.

The next two years: a realistic outlook

More automation, not autonomous cyber war

Generative AI can reduce the time required to translate messages, draft lures, produce images, summarise stolen documents and tailor public claims; defenders can use similar capabilities. On current evidence, the more defensible near-term expectation is faster production and greater volume, rather than fully autonomous campaigns that discover, compromise and exploit arbitrary targets without human direction or supporting infrastructure.

ENISA’s 2026 Threat Landscape reports growing use of AI to support malicious activity and assesses that more stages of the attack chain may become AI-enabled. It continues to identify ransomware as the most impactful incident type in the short term, while ideologically motivated DDoS accounts for a large share of recorded activity. The practical conclusion is that AI matters, but leaders should not allow speculative scenarios to displace work on identity, internet exposure, suppliers and service availability.

Persistent geopolitical alignment

Hacktivist activity is likely to continue following wars, sanctions, elections and contested policy decisions, with campaigns shifting rapidly as political events create new target lists. ENISA’s 2026 Threat Landscape identifies public administration as the most affected sector in its 2025 dataset, followed by business services, transport, manufacturing, and finance and banking.

The relationship between hacktivist groups and states will remain difficult to describe: some activity is state-run, some state-supported and some merely aligned. In Rethinking Cyber Deterrence in a Multipolar World, Louise Marie Hurel and Gareth Mott argue for an integrated, cross-domain approach that accounts for persistent activity below the threshold of armed conflict and the wider political context in which cyber operations occur. For executives, the practical posture is to resist catastrophic language while taking cumulative pressure and escalation pathways seriously.

Greater pressure on exposed operational systems

Internet-connected industrial and building systems will remain attractive because weakly secured interfaces can create visible physical effects. The most valuable improvement is often not a sophisticated detection model but removal of direct exposure, strong remote-access controls, asset ownership and tested manual operation. Boards should expect evidence that these basics extend to suppliers and inherited systems.

Counter-disruption will become more coordinated

Operation Eastwood demonstrates that investigators, prosecutors, national agencies and private technical specialists can coordinate across borders to disrupt infrastructure, identify suspects and warn alleged supporters of potential criminal liability. Such operations can impose costs and may deter some participation, but the published results do not establish how long the disruption lasted or how much future activity they prevented.

Organisations should make themselves useful partners. Reliable logs, named contacts, preserved evidence and prompt reporting matter more than public demands for retaliation. The speed of cooperation often depends on relationships built before an incident.

Questions every senior leadership team should be able to answer

Which services would cause the greatest human, operational or public harm if unavailable for an hour, a day or a week?
Do we know every internet-facing asset and remote route into operational technology, including those managed by suppliers?
Can our providers demonstrate DDoS protection at the network, protocol and application layers, and have we tested escalation?
Who decides whether an attacker’s claim is credible, and how will confidence and uncertainty be expressed?
How will customers reach essential information if our primary website, identity service or contact centre is unavailable?
What support will we provide if employees or customers are doxxed, threatened or impersonated?
Can legal, privacy, communications, operations and security leaders work from one incident picture?
Which regulators, national authorities, law-enforcement contacts and sector peers should hear from us, and when?
How will we communicate without amplifying propaganda or dismissing legitimate criticism?
What evidence would convince the board that recovery is complete and the underlying risk has been reduced?

Conclusion: resilience without alarmism

Hacktivism is neither a single movement nor a single class of technical threat. It is a changing mix of protest, disruption, propaganda, opportunism and, at times, state-aligned activity. Most incidents recorded in ENISA’s 2025 EU dataset were low-impact DDoS campaigns. Some incidents nevertheless interrupt essential services, expose personal data or test operational systems. Both statements can be true.

Senior leaders should avoid the comfort of dismissing attacks as unsophisticated. Sophistication is not a measure of consequence. They should also avoid portraying each campaign as evidence of imminent digital catastrophe. Hype rewards publicity-seeking actors, can produce poor investment decisions and may weaken trust when dramatic predictions fail.

The better response is grounded and empathetic. Protect the services people rely on. Reduce avoidable exposure. Make suppliers part of resilience. Rehearse difficult decisions. Support individuals who become targets. Communicate confirmed facts quickly, acknowledge uncertainty and correct errors openly. Work with authorities rather than improvising retaliation.

Above all, keep motive and method separate. A cause may deserve public debate while an unauthorised cyber act remains unlawful and harmful. An organisation can defend its systems firmly without treating lawful dissent as a threat. That balance is not weakness; it is the discipline required of institutions that want to remain secure, legitimate and trusted.

Hacktivism FAQ

Hactivism Myth-Buster

Get in Touch

Authoritative sources and further reading (more here)

What are your thoughts on hacktivism? Is it a force for good, a threat to stability, or something in between? Share your perspective in the comments and stay vigilant in the digital world. 🚀

Hacktivism 2026