Case Study: A Dangerous Public

In December 2010, a group of hackers took aim at Mastercard.com’s website and launched a denial of service (Dos) attack that took the website offline. The activists launched their denial of service attack to show support for WikiLeaks and WikiLeak’s founder Julian Assange. WikiLeaks had posted confidential documents about a number of governments and corporations, and, as a result, MasterCard decided to stop processing donations to WikiLeaks. The attack was called “Operation Payback.”¹ One credit card payment service reported that it could not process payments because of the attack. Although this attack did not ultimately impact MasterCard’s ability to process credit card transactions, consumers saw how vulnerable MasterCard was to attackers. Facebook and Twitter were then used to promote the attacks against the MasterCard brand. On Twitter, the attackers tweeted:

¹Esther Addley and Josh Halliday, “Operation Payback Cripples MasterCard Site in Revenge for WikiLeaks Ban,” The Guardian (December 8, 2010), http://www.guardian.co.uk/media/2010/dec/08/operation-payback-mastercardwebsite-wikileaks.

The MasterCard action was confirmed on Twitter at 9.39am by user @Anon_Operation, who later tweeted: “We are glad to tell you that http://www.mastercard.com/ is down and it’s confirmed! #ddos #WikiLeaks Operation: Payback (is a bitch!) #PAYBACK.”

What Could Have Been Done?

By monitoring these networks, MasterCard could have responded faster to the attacks, even as they were being discussed online. MasterCard’s communications with the public could have been swifter to reassure customers that charges were still being processed. The whole episode might have even been avoided if MasterCard had done more research into the ramifications of pulling the plug on WikiLeaks payment processing.

This type of activity can shift consumer sentiment about a company’s security capabilities, and MasterCard may have lost brand value (though this is hard to measure). MasterCard did not have a proactive response to communicate with consumers about the attack; it did not utilize other social media outlets to ensure people that a proper response was in place. If MasterCard had had social media influencers in place, those influencers could have released information quickly to different channels about the attacks. Social media was not the cause of the actual problem, but MasterCard could have used it as a countermeasure to inform consumers about what was happening.