The Heritage Foundation, a conservative think tank based in Washington, DC, confirmed in the week of April 8, 2024 that it had been the target of a cyberattack. The organisation shut down its network in response, with an official saying the step was taken to prevent further malicious activity while the incident was investigated.
A Heritage official told Politico that the attack likely came from nation-state hackers, but neither the official nor the organisation offered evidence for the attribution, and no country or group was named. It was not clear what, if any, data had been taken, and Heritage gave no further detail about how the intruders got in.
Think tanks are recurring targets because of their proximity to policy debates and the government experience of their staff. Heritage had been breached before: in 2015 attackers took internal emails and personal information belonging to donors.
A separate incident followed in July 2024, when the hacktivist group SiegedSec published about two gigabytes of Heritage related material, including names, email addresses and passwords belonging to contributors. Heritage disputed that it had been hacked on that occasion, saying the group had taken a two-year-old publicly available archive from a contractor's website rather than breaching its own systems.