Hacktivism combines hacking and activism. Hacktivists use cyber attacks to promote a political, ideological or social cause and to attract attention from the media and the public. Some groups act independently; others align with, or are tolerated by, a state.

Common methods

• Distributed denial of service (DDoS) attacks that take websites and online services offline for a time.
• Website defacement that replaces a page with a message.
• Hack and leak operations that steal and publish internal documents or personal data.
• Disruption of exposed systems, sometimes including poorly secured industrial controls.

Hacktivist campaigns often follow political events. Public administration, local government and operators of critical infrastructure are frequent targets. Groups regularly exaggerate the impact of their attacks, so claims need to be checked.

Why it matters for dark web monitoring

Hacktivists usually announce targets and claim results in public channels and forums. Monitoring those spaces can give early warning that an organization or its sector has been named, which leaves time to prepare DDoS protection and review exposed services. It also helps verify claims: a post saying data was stolen can be compared with what actually appears online, so the response matches the real leak, not the announcement.

Sources: NCSC: Warning over hacktivist groups disrupting UK organisations and online services, ENISA Threat Landscape