Heritage Foundation Hacked, Project 2025 linked to China

Post Reply New Topic

A group of self-proclaimed “gay furry hackers” says it breached the Heritage Foundation earlier this month, releasing two gigabytes of the right-wing think tank’s internal data on Tuesday. On its Telegram channel, the hacktivist collective SiegedSec — which has previously claimed responsibility for hacking NATO’s computer systems — said the Heritage hack was part of its #OpTransRights campaign, which also targeted the far-right media outlet Real America’s Voice and the Hillsong megachurch. The group also cited their objections to Project 2025, the Heritage Foundation’s policy proposal for a second term for former President Donald Trump, as a motivating factor.

In an email to The Verge, Heritage Foundation spokesperson Noah Weinrich denied that Heritage had been hacked, calling it a “false narrative and an exaggeration by a group of criminal trolls trying to get attention.”

“An organized group stumbled upon a two-year-old archive of The Daily Signal website that was available on a public-facing website owned by a contractor,” Weinrich said in an emailed statement. “The information obtained was limited to usernames, names, email addresses, and incomplete password information of both Heritage and non-Heritage content contributors, as well as article comments and the IP address of the commenter. No Heritage systems were breached at any time, and all Heritage databases and websites remain secure, including Project 2025. The data at issue has been taken down, and additional security steps have since been taken as a precaution.”

The Heritage Foundation claims the alleged hack was an exaggeration for attention, but in the meantime, Mike Howell, the executive director of the foundation’s Oversight Project, has triumphantly taken credit for disbanding “the Gay Furry Hackers.”

SiegedSec has released chat logs of a conversation one of its members claimed to have with Howell on Signal. The chat logs show a person who claims to be Howell asking a SiegedSec member why the group hacked the Heritage Foundation and threatening to expose the hackers.



Howell confirmed the legitimacy of the messages in an X exchange with a Daily Dot reporter.

Weinrich did not comment on the alleged messages between Howell and SiegedSec.

The messages also show Howell claiming to be “tied up with the fbi issuing a 2702 order” on SiegedSec’s social media. SiegedSec has indeed disbanded, a decision its members attribute to their “own mental health, the stress of mass publicity, and to avoid the eye of the FBI.”

A SiegedSec representative who goes by vio told The Verge they “completely expected” Heritage to deny that it had been hacked. “Many companies try denial to save face,” vio said. “The server we hacked was linked to The Daily Signal, and the server was named ‘first-heritage-foundation’. Clearly, Heritage was genuinely hacked.”

“Mike’s threats and insults showed anger that confirmed what Heritage denied,” vio said.

In a statement on Telegram, SiegedSec said the goal of the hack was to draw attention to — and combat — the Heritage Foundation’s anti-LGBT and anti-abortion policy proposals.

“The Heritage Foundation is a conservative think tank in America, among the most influential public policy organizations,” one SiegedSec member wrote on Telegram. “This organization is responsible for leading Project 2025, an authoritarian Christian nationalist plan to reform the United States government.” The hacked data, which was reviewed by CyberScoop, includes Heritage Foundation blogs and material related to The Daily Signal, a news website affiliated with the organization.

Heritage published Project 2025, its sweeping recommendations for a second Trump term, in April 2023, with a “broad coalition” of more than 100 other conservative organizations. The 900-plus-page “mandate for leadership” touches on virtually every sector of the executive branch, from the White House to the bevy of federal agencies under the president’s control.

Broadly speaking, its recommendations involve expanding presidential power, purging federal agencies of career employees, and replacing them with Trump loyalists. The mandate calls for dismantling entire federal departments — including the departments of Commerce, Education, and Homeland Security, the latter of which would be replaced with a new agency that is more extreme in its mission and less subject to oversight. Project 2025 also urges Trump to reverse the Food and Drug Administration’s approval of abortion pills, eliminate policies that promote “abortion as health care,” outlaw pornography, and shut down “telecommunications and technology firms that facilitate its spread.”

The mandate’s chapter on the Federal Communications Commission — written by Brendan Carr, the agency’s head under Trump — calls for the imposition of “transparency rules on Big Tech” and an overhaul of Section 230 of the Communications Decency Act, the law that states that “interactive computer services” can’t be treated as the publishers or speakers of third-party content published on their platforms. Carr claims that Section 230 allows tech companies to “censor protected speech,” echoing claims that major social media companies suppress right-wing viewpoints.

Trump recently attempted to distance himself from Project 2025, claiming he has “no idea” who is behind the plan — even though a CNN analysis found that more than 140 former members of his administration were involved in drafting the mandate.

An established cybercrime group with a track record of attacking political targets posted on Tuesday roughly two gigabytes of data from the Heritage Foundation, a prominent conservative think tank based in Washington, D.C.

Self-described “gay furry hackers,” SiegedSec said it released the data in response to Heritage Foundation’s Project 2025, a set of proposals that aim to give Donald Trump a set of ready-made policies to implement if he wins this fall’s election. Its authors describe it as an initiative “to lay the groundwork for a White House more friendly to the right.”

The data, reviewed by CyberScoop, includes Heritage Foundation blogs and material related to The Daily Signal, a right-wing media site affiliated with Heritage. The data was created between 2007 and November 2022.

The group says it gained access to the data on July 2 and released it to provide “transparency to the public regarding who exactly is supporting heritage (sic),” a spokesperson for the group who goes by the online handle “vio” told CyberScoop in an online chat Tuesday.

The data includes the “full names, email addresses, passwords, and usernames” of people associating with Heritage, vio said, including users with U.S. government email addresses. “This itself can have an impact to heritage’s (sic) reputation,” they added, “and it’ll especially push away users in positions of power.”

A Heritage spokesperson told CyberScoop after publication that the organization was not “hacked.” Instead, the spokesperson said “an organized group stumbled upon a two-year-old archive of The Daily Signal website that was available on a public-facing website owned by a contractor. The information obtained was limited to usernames, names, email addresses, and incomplete password information of both Heritage and non-Heritage contributors, as well as article comments and the IP address of the commentor.”

No Heritage systems were breached at any time, the spokesperson said, and the story of a hack “is a false narrative and an exaggeration by a group of criminal trolls trying to get attention.”

SiegedSec also claimed to be in possession of more than 200 gigabytes of additional “mostly useless” data, which the group said won’t be released.

The attack was carried out as part of SiegedSec’s “OpTransRights,” campaign, which has previously included the defacement of government websites and data theft from states either considering or implementing anti-abortion or anti-trans legislation.

The Heritage Foundation did not respond to a request for comment Tuesday. The attack marks the second suffered by Heritage this year. In April, a Heritage official told Politico that the think tank had shut down its network in response to a breach by a nation-state hacking group.

Democrats have sought to tie Trump to Project 2025 proposals as an example of what to expect from his second term. Heritage President Kevin Roberts made news last week when he said the American right was “in the process of the second American Revolution, which will remain bloodless if the left allows it to be.”

SiegedSec, which emerged on Telegram in April 2022, has also targeted various NATO portals, the city of Fort Worth and a company involved in the monitoring of offshore oil and gas facilities.

Self-described “gay furry hackers” on July 2 breached archival data from a site that was operated by the Heritage Foundation until recently, and on Tuesday released two gigabytes of internal data originally collected by the conservative think tank. Now an executive director at the influential organization is so hopping mad that he might as well invest in a kangaroo costume.

The hacktivist collective, SiegedSec, has been engaged in a campaign called “OpTransRights,” in which it targets government websites with the aim of disrupting efforts to enact or enforce anti-trans and anti-abortion laws. Heritage Foundation was selected due to its Project 2025 plans, seen as a blueprint for Donald Trump to reshape the U.S. with sweeping far-right reforms should he win another term as president, SiegedSec told CyberScoop on Tuesday. Group member “vio” informed the outlet that they aimed to provide “transparency to the public regarding who exactly is supporting” Heritage, and that the leaked data included “full names, email addresses, passwords, and usernames” of individuals linked to the nonprofit.

This material, as the Daily Dot reported and as the Heritage Foundation now confirms, came from the Daily Signal, Heritage’s media and commentary site, which lists one Mike Howell as an investigative columnist. The former Trump administration official in the Department of Homeland Security is also the executive director of Heritage’s Oversight Project, an initiative focused on border security, elections, and countering the “influence” of the Communist Party of China. It was Howell who contacted SiegedSec in the wake of the breach to get answers about their motivations — and as he continued to message “vio,” his texts grew more unhinged and threatening.

After declining to talk with Howell by phone, vio described what it was that they and their hacker furry comrades sought to accomplish: “We want to make a message and shine light on who exactly supports the Heritage foundation,” they wrote. “We don’t want anything more than that, not money and not fame. We’re strongly against Project 2025 and everything the Heritage foundation stands for.” Howell seemed stunned by the explanation. “That’s why you hacked us?” he replied. “Just for that?” (Once the full chat log was released by SiegedSec, Howell confirmed to the Daily Dot that it was genuine, and that the conversation had taken place on Wednesday.)

From there, Howell’s tone shifted. “We are in the process of identifying and outing [sic] members of your group,” he wrote. “Reputations and lives will be destroyed. Closeted Furries will be presented to the world for the degenerate perverts they are.” As vio expressed skepticism that anyone in SiegedSec would be identified and continued to criticize the Heritage agenda as harmful to human rights, Howell invoked Biblical authority and seethed that the hackers had “turned against nature.”

“God created nature, and nature’s laws are vicious. It is why you have to put on a perverted animal costume to satisfy your sexual deviances,” Howell wrote. “Are you aware that you won’t be able to wear a furry tiger costume when you’re getting pounded in the ass in the federal prison I put you in next year?” When vio taunted the executive for this outburst and hinted that they would be posting the conversation online, Howell replied, “Please share widely. I hope the word spreads as fast as the STDs do in your degenerate furry community.”

He went on to liken furry culture to bestiality, which he called a “sin,” prompting vio to ask him, “whats ur opinion on vore.” (Vorarephilia, or vore, is a fetish typically expressed in erotic art of people or creatures eating one another.) A Twitter user shared a screenshot of this exchange Wednesday afternoon, leading Howell to quote-tweet the post with lyrics from rapper Eminem‘s 2000 single “The Way I Am.”

Hours later, Howell learned through the Daily Dot‘s reporting that vio had decided to try to quit their life of cybercrime, and that the rest of the collective agreed it was “time to let SiegedSec rest for good,” in part to avoid FBI attention. “COMPLETE AND TOTAL VICTORY,” Howell tweeted. “I have forced the Gay Furry Hackers to DISBAND.”

But it remains to be seen whether these hackers — who last year managed to breach NATO systems as well as a major U.S. nuclear lab that they demanded begin research on “creating IRL catgirls” — will truly disappear into the shadows. Like an empowering fursona, hacking can be an identity that’s hard to give up. Before he congratulates himself any more, Howell might want to at least change his passwords.

Update July 11, 3:50 p.m.: After publication, the Heritage Foundation sent Rolling Stone a statement clarifying that the site was not operated by the think tank, and disputing that they were hacked. The story has been updated to reflect this, and the full statement can be found below:

“The Heritage Foundation was not hacked. An organized group stumbled upon a two-year-old archive of The Daily Signal website that was available on a public-facing website owned by a contractor. The information obtained was limited to usernames, names, email addresses, and incomplete password information of both Heritage and non-Heritage content contributors, as well as article comments and the IP address of the commenter. No Heritage systems were breached at any time, and all Heritage databases and websites remain secure, including Project 2025. The data at issue has been taken down, and additional security steps have since been taken as a precaution. The story of a ‘hack’ is a false narrative and exaggeration by a group of criminal trolls trying to get attention.”