Early public discussion often treated “hacktivists” as a single community. In practice, the term covers loose volunteer collectives, persistent groups with recognised brands, opportunists seeking attention, criminal actors borrowing a cause and state-aligned networks whose relationship with government may be indirect or deliberately obscured. A group may act independently, receive encouragement, share a geopolitical objective or operate as a deniable proxy; an intermediary whose involvement can obscure who directed an operation. Those possibilities should not be collapsed into one claim. For the wider threat-actor context, see ENISA Threat Landscape 2025 and the European Union Agency for Law Enforcement Cooperation (Europol)’s Operation Eastwood account.

The ENISA 2025 Threat Landscape attributed 79.4% of assessed objectives in its dataset to ideology-driven activity and reported that only 2% of hacktivism incidents led to service disruption. The category was dominated by low-impact DDoS. That does not mean an organisation’s chance of serious harm is 2%: the figure reflects the agency’s observations, classifications and available reporting. It should calibrate language, not substitute for an assessment of local service dependencies or vulnerable users.

The 2025 edition covers 1 July 2024–30 June 2025, whereas the 2026 edition covers 1 January–31 December 2025. Their reporting periods overlap by six months; they are not independent consecutive annual datasets. ENISA records a version 1.3 revision of the 2025 full report dated 22 September 2026, correcting figures and updating links. The percentages above are attributed specifically to the separately linked overview booklet, rather than presented as newly verified figures from that revised full report.

Public claims can be an important part of a hacktivist campaign because they amplify visibility beyond the technical event. Treat screenshots, countdowns and declarations of success as claims to be verified rather than proof of disruption. The first internal brief should therefore separate observed facts, attacker assertions, unresolved questions and the organisation’s next actions.

DDoS seeks to exhaust resources so legitimate users cannot obtain a service; it does not, by itself, prove that attackers accessed internal systems. The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC)’s joint guidance distinguishes volumetric attacks that consume bandwidth, protocol attacks against network resources and application attacks against particular services. Here, bandwidth means available data-carrying capacity; a protocol is a set of communication rules; and an application is a software program or service. The distinction matters commercially: a provider’s headline capacity does not necessarily establish protection for authentication (verification of a user’s, process’s or system’s identity), search or other demanding application functions. Leaders should ask which customer outcomes the protection actually preserves.

The operational impact depends on architecture and context. An attack against a well-protected public website may cause little more than alert noise. The same traffic directed at a fragile authentication service, booking platform or citizen portal can block access at a politically sensitive moment. A brief outage can also trigger longer disruption when teams disable services, change routing or take systems offline while they investigate. The business loss may therefore arise as much from uncertainty and recovery activity as from the attack traffic.

Some groups move beyond disruption into credential theft (stealing sign-in information), data exfiltration (unauthorised transfer of information from a system), extortion or manipulation of internet-connected industrial systems. At that point, the practical response becomes closer to a conventional breach or hostile-state incident. The motive may remain ideological, but the consequences to individuals and the organisation are governed by the data taken, the systems changed and the services affected.

In their December 2025 joint advisory, Pro-Russia hacktivists conduct opportunistic attacks against US and global critical infrastructure, CISA and its international co-authors recommend reducing the public internet exposure of operational technology (OT), mapping assets and access paths, and strengthening authentication. The National Institute of Standards and Technology’s glossary describes OT as programmable systems and devices that monitor or control physical processes. This article’s management interpretation is that preventable weaknesses can expose systems with physical consequences, even where an attacker lacks advanced capabilities. A credible indication of unauthorised control-system access should therefore trigger operational and safety expertise immediately, rather than waiting for certainty about the attacker’s identity or motives.

Leaders should avoid a false choice between “hacktivism” and “serious cyber attack”. The same incident can begin with symbolic disruption and reveal a deeper compromise; conversely, a noisy claim may mask very limited capability. Incident classification should follow evidence and business consequence, not the attacker’s self-description.

NoName057(16) illustrates the persistence achievable through shared tools and recruited participation. Europol’s account of Operation Eastwood describes sympathisers using automated tools, motivated by ideology and rewards. Leaders should not equate the apparent skill of individual participants with the cumulative burden of a campaign. Repeated attempts can require sustained provider coordination and staff attention even when each event is contained. Preparedness should include rota cover, delegated decisions and thresholds for longer-running disruption, not simply a one-off emergency checklist.

In July 2025, Europol reported that Operation Eastwood disrupted infrastructure comprising more than 100 computer systems and that national authorities had issued seven arrest warrants. Giulia Segreti and Thomas Escritt’s contemporaneous Reuters report, Seven arrest warrants issued in global swoop on suspected Russia-linked hackers, independently covered the action and noted that prosecutors did not specifically link the suspects to the state. This article draws two limited conclusions from those accounts: international cooperation can impose tangible costs, and ideological alignment does not itself establish state direction. Neither account establishes that the network was permanently eliminated. The recommended implication is to retain organisational continuity capability after an enforcement announcement.

The NCSC’s January 2026 warning specifically highlighted local government and critical infrastructure. For management, the useful question is not simply whether a website survives but whether an important service remains reachable. If an online form becomes unavailable, demand may move to telephones, reception desks or partner organisations. That is a scenario to test, not an assumed consequence of every incident. Capacity planning should include those alternatives and identify who will prioritise urgent cases if demand exceeds the fallback service’s capacity.

A useful exercise asks whether a person can complete an essential task while the main website and its sign-in service are unavailable. The answer should be demonstrated through a realistic test, including accessibility and support for people who cannot switch channels easily. Success is continuity of the outcome, not the availability of a homepage. Funding decisions should therefore compare the benefits of additional technical capacity with independent communications, alternative access and trained operational cover.

The 2024 CISA and partner fact sheet on operational technology described activity that was often unsophisticated but could pose physical threats in insecure or misconfigured environments. The subsequent 2025 advisory reinforced the priority of removing avoidable exposure. This calls for a different escalation threshold from a publicity-driven website claim. Operational leaders must establish whether changes occurred, whether readings can be trusted and whether continued operation is safe. Technology teams should not make those judgements without the responsible engineers and service operators.

Senior leaders should ask whether remote maintenance paths are inventoried, whether suppliers use individual and strongly authenticated accounts, whether engineering workstations and controllers (computers used to configure industrial systems and devices that direct physical processes) are monitored, and whether operations can continue safely if remote access (access through an external network) is suspended. These are governance questions as much as engineering questions because they involve cost, contracts, service availability and risk acceptance.

A hostile claim can become a second incident if employees, customers or journalists cannot find an authoritative account. The recommended discipline is to separate confirmed service effects, evidence of intrusion and unverified public assertions. A screenshot may justify investigation but does not establish current control of a live system. Communications teams should have a direct route to technical and operational evidence, with clear authority to correct demonstrably false claims without waiting for a complete attribution assessment (an assessment of who carried out or directed the activity).

The practical response is not to label criticism as disinformation. Organisations need a disciplined evidence process, rapid correction of demonstrably false operational claims and continued respect for legitimate protest, journalism and public scrutiny. When businesses appear to dismiss a grievance simply because an unlawful actor has adopted it, they can alienate employees, customers and communities who share the concern but reject the method.

Plan for the management workload as well as the availability problem. An exercise should test whether security teams can assess a possible accompanying intrusion while digital teams protect customer journeys, communications teams prepare statements, and legal and privacy specialists assess personal-data implications. Include questions from regulators, clients and the board. Do not assume that restoring the website ends the incident: establish what evidence is needed to conclude that no related compromise has been identified, and resource that investigation proportionately.

The executive objective should be continuity of important outcomes, not mere survival of a particular server (a computer or system providing services to other computers). If the main website fails, can customers still reach urgent information? If online booking is unavailable, is there a prioritised manual route? If a supplier absorbs the traffic, are escalation contacts and commercial limits understood? Mapping essential services to their digital dependencies turns a generic cyber scenario into a business-continuity decision about sustaining operations through disruption.

Doxxing (sharing someone’s personal information online without consent, typically to intimidate or punish) and data leakage require a distinct people-centred response. The UK data-protection regulator, the Information Commission’s Office (ICO), publishes personal-data breach guidance covering confidentiality, integrity and availability: protection against unauthorised disclosure, improper alteration and loss of access, respectively. Under the United Kingdom General Data Protection Regulation (UK GDPR), a controller (the body deciding why and how personal data is processed) must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach, unless it is unlikely to result in a risk to individuals’ rights and freedoms. A processor (a body processing personal data on the controller’s behalf) must notify the controller without undue delay after becoming aware of a breach. Where a breach is likely to result in high risk, the controller must also inform affected people without undue delay, subject to applicable legal exceptions. Document the breach and the notification assessment even where notification is not required.

A humane response starts with those affected. People need plain information about what is known, what data was involved, what practical steps they can take and where to obtain help. A legalistic notice that minimises concern may meet neither the organisation’s ethical duty nor its long-term interest. Equally, premature certainty can cause needless alarm. Communications should state the scope of evidence, recognise uncertainty and commit to updates.

Leaders should also consider the burden on frontline teams. Employees whose names appear in hostile channels may need security advice, time away from public-facing duties or support for family concerns. An incident plan that focuses only on systems can miss the most serious human consequences.

Include symbolic targeting in the organisation’s threat scenarios. Consider whether prominence, government contracts, a contested sector or association with a controversial decision could attract attention, without assuming that any of these factors predicts an attack. Security controls cannot settle the underlying disagreement. As a preparedness measure, combine technical protection with public-affairs awareness, stakeholder listening and clear organisational values.

This does not mean conceding to unlawful pressure. It means understanding the narrative environment early enough to communicate with precision. Leaders should know which claims can be answered with verifiable facts, which concern legitimate policy disagreement and which should not be amplified. Where the organisation made a mistake, the recommended approach is to acknowledge verified facts and explain corrective action rather than issue a reflexive denial. Where a claim is false, publish supporting evidence in a form that customers, journalists and employees can understand, subject to privacy, security and legal constraints.

For a private-sector organisation, prioritise contractual services, customer access and the dependencies behind revenue and fulfilment. For a public body, consider statutory functions, urgent access and people unable to use alternatives. For a charity or other third-sector organisation, include beneficiary confidentiality, safeguarding, donation journeys and volunteer coordination. These are planning lenses, not claims that every organisation in a sector has the same exposure. Service owners should identify actual harms, including where a supplier or partner carries part of the responsibility.

Smaller organisations should concentrate resources on their most important services rather than imitate a large security operation. Buy clear provider commitments, restrict administrative access (privileged access used to manage systems) and maintain a tested contact and continuity plan. Larger organisations should additionally challenge concentration risk: apparently separate services may share an identity platform, which manages sign-in, a domain administrator with extensive access privileges across a group of centrally managed systems, or a managed provider. In either case, require named owners, out-of-hours escalation, agreed evidence access and a demonstrated recovery route. Outsourcing delivery does not remove the need to understand what will happen when it fails.

The UK Computer Misuse Act 1990 distinguishes unauthorised access under section 1 from unauthorised acts intended, or reckless as to whether they will, impair computer operation under section 3. Ideological motivation does not itself supply authorisation. Leaders should preserve that boundary without treating all digital activism as criminal. Lawful protest, research and public-interest scrutiny must be distinguished from unlawful access or interference. Obtain legal advice on specific incidents and jurisdictions rather than assuming that the label “hacktivism” determines the offence, defence or reporting obligation.

Attribution combines technical, behavioural, contextual and intelligence judgements. A familiar tool, language or target list may support an assessment but rarely proves who directed an operation. Some groups align themselves with a state’s objectives without being under day-to-day control; others may be encouraged, tolerated or resourced in ways that remain opaque. ENISA Threat Landscape 2026 provides context on converging methods across threat-actor categories; Reuters’ Operation Eastwood reporting illustrates the distinction between pro-Russian alignment and a specifically established state link.

Executives should use language such as “the activity is consistent with”, “the group claimed responsibility” or “government agencies assess” unless stronger evidence is available. Public accusation can have diplomatic, legal and commercial consequences. It can also distract response teams from the immediate task of restoring service and protecting people.

Proportionate response is not passivity. It means matching action to evidence, consequence and legal authority. Removing malicious infrastructure, preserving evidence, reporting crime and cooperating with national authorities can be justified. Monitoring public channels for threats can be legitimate when carried out lawfully. Infiltrating groups, collecting excessive personal data or retaliating against systems creates legal and ethical risk and should not be improvised by a victim organisation.

Before an incident, legal and compliance teams should maintain a notification matrix covering applicable regulators, commissioning bodies, contractual counterparties and insurers. Record the trigger, deadline, decision-maker and fallback contact for each obligation. Not every outage is a reportable personal-data breach; equally, loss of access to personal data can matter without exfiltration. Separate the decision to seek confidential help from the decision to make a public attribution. Both should be timely, but they require different evidence and carry different consequences.

Begin with business outcomes. Identify the digital services whose loss would affect safety, essential operations, vulnerable people, regulatory obligations or public confidence. For each service, document its owners, external dependencies, fallback arrangements and maximum tolerable disruption. Include communications channels: an organisation that cannot publish trusted updates during an attack has lost part of its response capability.

Use scenarios that combine events rather than testing a single control. A realistic exercise might pair a DDoS attack with a false claim of data theft, hostile contact with employees and a supplier outage. Executives then have to decide what to say, whether to invoke continuity plans, who contacts authorities and what evidence would justify changing the incident classification.

Reduce avoidable exposure before buying another specialist product. Maintain ownership of internet-facing assets, remove unnecessary services, address exploitable vulnerabilities (weaknesses in systems, procedures or controls that a threat could exploit) and strengthen administrative authentication. For operational technology, follow the international advisory’s priorities: reduce public exposure, map assets and access paths, and enforce robust authentication. Changes to operational environments require engineering review and safe implementation. Ask for evidence of coverage, including supplier-managed and inherited systems, rather than a general assurance that the organisation follows good practice.

For availability, establish capacity and mitigation with upstream providers. Understand whether protection covers network, protocol and application attacks; how quickly it activates; what happens when limits are exceeded; and who can authorise emergency routing changes. Test the process. A contract is not a control until the escalation path works at 2 a.m.

Threat intelligence (analysed threat information put into context for decision-making) should answer operational questions: Is the organisation named? Are credentials or documents being offered? Is a specific date or service mentioned? Does observed traffic match the claim? What action would change because of this information?

Monitor lawful, relevant public sources and trusted information-sharing communities. Do not ask staff to enter hostile forums without appropriate tools, training, legal review and personal-safety safeguards. Collection should be necessary, proportionate and retained only as long as required. The purpose is early warning and evidence, not surveillance of lawful critics.

Agree who declares a major incident, approves emergency spending, suspends a service and authorises external messages. Name deputies and reachable provider contacts. The UK Cyber Governance Code of Practice places risk management, strategy, people, incident preparedness and assurance within board-level oversight. Use that framework to assign accountability without drawing directors into technical command. A small organisation may combine roles, but it still needs explicit authority and a way to challenge decisions when the normal decision-maker is unavailable.

Keep the board’s role strategic. Directors should challenge whether management understands exposure, has tested dependencies and can support affected people. They should not direct packet-level response (handling the individual units of data transmitted across a network). During an incident, a short dashboard should cover service impact, people affected, evidence of intrusion, decision points, legal notifications, communications and recovery confidence.

Use a simple rhythm: confirm the service impact; state what is being done; provide an alternative route; distinguish confirmed facts from attacker claims; and commit to the next update. Avoid repeating slogans, linking to hostile channels or speculating about attribution. If personal data may be involved, coordinate public messaging with the privacy assessment but do not allow legal caution to produce silence.

Prepare messages for different audiences. Customers need practical alternatives. Employees need instructions and reassurance about personal risk. Partners need technical coordination. Regulators and authorities need timely facts. Journalists need a credible point of contact. Consistency matters, but identical wording does not meet every audience’s needs.

Recovery is not complete when traffic returns to normal. Verify that no related intrusion occurred, review logs (records of events occurring within systems or networks) and supplier actions, close exposed services, support affected individuals and update risk decisions. Preserve a clear chronology of observations and decisions.

Publish a proportionate account when public interest or stakeholder impact justifies it. Explain what happened, what did not happen, how people were affected and what will change. Avoid declaring victory over an adversary. Accountability is more durable than bravado, and it gives employees and customers a reason to trust the organisation after a difficult event.

Cherilyn Pascoe, Stephen Quinn and Karen Scarfone’s The NIST Cybersecurity Framework (CSF) 2.0, published by the National Institute of Standards and Technology (NIST), provides the framework used here to connect governance, identification, protection, detection, response and recovery. NIST’s Current and Target Profiles describe present and desired cybersecurity outcomes. This article recommends using those resources to assess capability gaps rather than creating a separate hacktivism bureaucracy. Prioritise improvements by service consequence and demonstrable benefit. A new monitoring service may be less valuable than fixing unowned exposure, verifying a provider escalation route or giving customers an independent way to obtain essential information.