Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
hacktivist-operationbreach-disclosure-notificationunderground-data-leakidentity-impersonation-fraud

Anonymous Breached HBGary After CEO Claimed He Identified Members

Updated 28d agoFirst seen May 25, 202614 sources

Anonymous-affiliated attackers breached HBGary Federal after CEO Aaron Barr publicly claimed he had identified key members of the collective and was preparing to share findings with the FBI. The intrusion reportedly combined website exploitation, password reuse, and social engineering, leading to the defacement of HBGary systems, takeover of Barr’s Twitter account, theft of more than 50,000 emails, and exposure of company financial and internal documents. Reporting on the operation described participants from AnonOps and highlighted disputed claims around a hacker using the alias "Kayla", while leaked IRC logs later portrayed Anonymous as more coordinated than its public image suggested, with figures such as Sabu directing activity and discussing the HBGary attack.

The leaked HBGary emails triggered wider fallout by exposing proposals tied to campaigns against WikiLeaks and critics, including plans reportedly prepared for clients connected to Bank of America and a law firm, and renewed scrutiny of the firm’s ties to federal agencies. Subsequent reporting said former Anonymous supporters provided chat logs and alleged identities to investigators, and later arrests brought the hacking saga closer to a conclusion. The episode became a defining early example of hacktivist retaliation escalating into a major corporate breach, reputational crisis, and law-enforcement investigation.

Share:
Anonymous Breached HBGary After CEO Claimed He Identified Members
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

EVENT TIMELINE

How this story unfolded

9 events from the most recent confirmed update back to the earliest known activity.

9 EVENTS
Mar 6, 201214y ago

Arrests bring the HBGary hack saga toward closure

By March 2012, arrests connected to Anonymous and related hacking activity were reported as bringing the HBGary case close to its end. The law-enforcement action marked the final major development in the publicly documented saga covered by these references.

Mar 18, 201115y ago

Leaked Anonymous IRC logs suggest de facto leadership and HBGary role

Published logs from Anonymous's private #HQ IRC channel, reportedly supplied by former supporters to journalists and law enforcement, suggested that figures such as Sabu directed operations despite public claims that the group was leaderless. The logs also included admissions and discussion tying participants to the HBGary intrusion and other attacks.

Mar 16, 201115y ago

Media profile alleged 'Kayla' participant in HBGary hack

Articles in March profiled a person using the alias 'Kayla,' presented as a teenage Anonymous supporter who allegedly helped compromise HBGary through impersonation and other tactics. Subsequent coverage treated the identity claims skeptically and noted uncertainty over who was actually behind the persona.

Feb 28, 201115y ago

Aaron Barr resigns from HBGary Federal after hack fallout

HBGary Federal CEO Aaron Barr resigned following the Anonymous breach and the ensuing controversy over leaked emails and his claims about identifying Anonymous members. His departure marked a significant corporate response to the scandal.

HBGary Federal's Aaron Barr Resigns After Anonymous Hack Scandal
Feb 16, 201115y ago

Salon reports HBGary Federal's ties to federal agencies

Follow-on reporting highlighted HBGary Federal's relationships with US government and law-enforcement entities amid scrutiny of the leaked emails and anti-WikiLeaks proposals. This expanded attention to the firm's broader role beyond the immediate breach.

Feb 11, 201115y ago

Leaked HBGary emails expose anti-WikiLeaks proposal

Emails stolen in the HBGary breach revealed proposals by HBGary Federal, Palantir, and Berico to support a law firm's plans for Bank of America, including disinformation and pressure tactics aimed at WikiLeaks and its supporters. The disclosures broadened the story from a hack into a political and corporate scandal.

Feb 10, 201115y ago

Reports identify social engineering used in the HBGary intrusion

Detailed reporting described how Aaron Barr's public profile and reused credentials helped Anonymous gain access, including impersonation of Barr in communications with a Nokia security contact. These accounts clarified the mechanics of the breach and the role of operational security failures at HBGary.

Feb 6, 201115y ago

Anonymous hacks HBGary Federal and leaks Aaron Barr's emails

On Super Bowl Sunday, Anonymous-affiliated attackers compromised HBGary Federal, defaced its website, took over Barr's Twitter account, stole tens of thousands of emails, and exposed internal company data. The intrusion reportedly used weak passwords, social engineering, and access to related systems, and was framed by the attackers as retaliation for Barr's claims.

Feb 5, 201115y ago

Aaron Barr says he identified Anonymous leaders

HBGary Federal CEO Aaron Barr publicly claimed he had identified key members of Anonymous using social-media analysis and was preparing to brief or share findings with federal authorities. The claims triggered backlash from Anonymous and set up the subsequent retaliation.

The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.

Anonymous Breached HBGary After CEO Claimed He Identified Members | Mallory