In May 2012, after a run of attacks by groups such as Anonymous and LulzSec, enterprise security teams were asking what hacktivism should change about how they defend their systems. Surveys cited at the time showed that most IT and security professionals regarded Anonymous as a serious threat to their companies. The experts quoted that year largely agreed that most enterprises should change their approach.
Why would hacktivists pick an ordinary company?
Mark Rasch, then director of cybersecurity and privacy consulting at Computer Sciences Corporation, argued that firms could not reliably predict whether they would be targeted. He used the example of a mid-sized widget maker in Wisconsin that sees no reason for anyone to attack it.
His point was that the trigger might not be anything the company itself did. A public relations firm hires an advertising agency, which hires an actress, and something said in the resulting advertisement offends a group. The company then becomes a target through circumstance. Rasch’s advice was to drop any belief that obscurity offers protection.
Shawn Moyer, then practice manager for research consulting at Accuvant Labs, added that security teams needed to watch the public actions of their employers. Any such action could draw attention, and teams needed to be ready to react.
What did hacktivist attacks look like in 2012?
The range was wide. Attacks included traditional website defacement and denial-of-service floods. They also included theft of intellectual property or log-on credentials, which was then dumped publicly to embarrass the victim.
John Pescatore, then vice president and research fellow at Gartner, said that most of the successful Anonymous attacks exploited very poor security practices. He noted that denial-of-service attacks had caught many companies off guard. Firms that were suddenly seen as opposing WikiLeaks, for example, found themselves hit with traffic floods.
Which defences did the experts prioritise?
Pescatore urged organisations to strengthen their protection against denial of service. He compared it with backup power. Companies had learned, after lightning strikes and power cuts, that a data centre without electricity was nearly useless, and they now paid for generators. In his view the Internet connection deserved the same reliability. A data centre with power but no connectivity, he said, was an expensive lump of metal.
Another expert recommended that enterprises check how exposed their sites were to defacement, if only to avoid public embarrassment.
Rasch put the most weight on incident response. He described a shift away from trying to stop every attack with moats and castles. The new assumption was that a determined attacker would probably get into some part of the network. That made fast detection and response as important as prevention.
Was compliance enough?
Moyer and others argued that it was not. In his view, many security teams had spent several years concentrating on passing a stream of IT audits. That produced a checkbox mentality that would not stand up to a competent adversary. His broader point was that it did not matter much whether Anonymous specifically chose a given company. Weak security practices would eventually cause damage regardless of who exploited them.
How did hacktivism develop afterwards?
Denial of service remained central to hacktivism. In its 2026 DDoS statistics roundup, SentinelOne said hacktivism remained the main driver behind many large-scale DDoS campaigns. It said hundreds of Telegram channels were coordinating target lists and amplifying claims. The same roundup said that typical enterprises had faced about 3.85 DDoS incidents over the previous 12 months.
MazeBolt’s review of the first quarter of 2026 described DDoS as a global availability threat. It said many of the most visible attacks were linked to geopolitical hacktivism, with groups such as NoName057 appearing in campaigns across Europe and the Middle East. Government services, telecom providers, banks, transport and infrastructure operators were repeatedly targeted. MazeBolt said the risk was not limited to one industry or region, which echoes the 2012 warning that any company could be drawn in.
Law enforcement has also acted against some groups. In February 2026 Bitdefender reported that Spanish authorities had arrested four core members of the hacktivist group Anonymous Fénix. The group had launched DDoS attacks on ministries, political parties and public institutions. Bitdefender said police also seized its X, YouTube and Telegram accounts.
SentinelOne also noted that some groups blur the line between activism and money. Some advertise “stress test” services on Telegram and use claimed attacks as demonstrations to attract paying clients. It added that ransom-driven DDoS campaigns often hit online services, finance and telecom targets at peak hours, so that even a short outage creates pressure to pay.
What stays the same for enterprise defenders?
The core of the 2012 advice was to assume that an attack would come, make the Internet connection resilient, fix basic weaknesses and be able to respond quickly. The 2026 sources describe the same pressure points: availability, public-facing services and a wide range of targets.