Tenzin Nyidon
DHARAMSHALA, Nov. 4: The website of the prominent Dharamshala-based research organisation, the Tibetan Centre for Human Rights and Democracy (TCHRD) has fallen victim to another cyberattack, Phayul has learned. Following the breach, TCHRD, in coordination with the Tibetan Computer Emergency Readiness Team (TibCERT), launched an investigation to determine the nature, and extent of the intrusion, assess potential data exposure and identify the vulnerabilities exploited by the attackers.
Speaking to Phayul, TibCERT Programme Manager Tenzin Gyal, Database and Systems Manager Gemphel Norsang, and Director Tenzin Thayai said TCHRD staff first noticed the website became inaccessible on Friday between approximately 10 and 11 a.m. The organisation subsequently alerted TibCERT, whose technical team detected the security breach shortly afterward.
Phayul asked about the nature of the intrusion and whether the website had been defaced, redirected or had its content altered, Gyal said the website had been rendered inaccessible. Describing the severity of the incident, Gyal said the error encountered was unlike the usual technical issues associated with website outages. He could not access either the website’s administrative interface or its servers, suggesting a more serious compromise.
He said the team subsequently contacted Gandi, the website’s hosting provider, after opening a support ticket. Gandi reportedly identified an open port as the point of vulnerability through which the website had been compromised and provided two files for remediation. However, Gyal cautioned that the vulnerability identified so far might not fully account for the breach, suggesting there could be additional layers to the intrusion they have yet to uncover. He said the investigation and technical analysis were still underway and that further details could not be disclosed at this stage.
Thayai said they had created website backups but were still working to establish the full extent of the compromise. Approximately 20,000 files remain to be scanned as part of the forensic examination. The team has also exported hidden data from the web-hosting environment and is assessing its integrity to determine whether any files were modified, which accounts or users may have been accessed without authorisation, and what information might have been exposed. The identity of the attackers, their motives and the methods employed in the intrusion remain unknown.
When asked whether sensitive information, particularly details relating to sources, researchers and individuals inside Tibet, might have been compromised, Thayai said the team could not yet establish the extent of the potential data exposure.
Gemphel explained that information stored on or uploaded through the website could be vulnerable depending on the level of access obtained by the attackers. For instance, information associated with an editor responsible for uploading reports could potentially be exposed, raising concerns that user credentials, including login IDs and passwords, might also have been compromised. He added that TibCERT employs strong password-encryption measures, which could make credential compromise more difficult. However, the team could not conclusively determine which information had been accessed or exposed.
Thayai emphasised that the extent of the damage would also depend on the nature and capabilities of the malware deployed by the attackers. Until the technical analysis is completed, they cannot confirm what the malicious software may have accessed, altered or extracted.
On whether the attack could be politically motivated, Gemphel said the motive, nature and attribution of the intrusion remained unclear. They are still examining the attack methods and technical indicators before drawing any conclusions about those responsible.
Thayai, however, noted that cyberattacks targeting the Tibetan community have frequently been associated with China-linked threat actors. He said they would examine the attack patterns, tactics, techniques and procedures (TTPs), as well as indicators of compromise, and compare them with the known behavioural patterns of advanced persistent threat (APT) groups to assess whether the incident could be linked to previously identified actors. He stressed that attribution would require technical evidence and could not be established merely on the basis of the target or the political context.
The incident has also renewed concerns about the growing vulnerability of Tibetan civil society organisations to increasingly sophisticated cyber threats, even when they follow established cybersecurity practices.
The experts warned that advances in artificial intelligence are giving malicious actors new capabilities to automate, accelerate and scale cyberattacks, potentially increasing both their frequency and sophistication. They cited the case of the late Tibetan self-immolator Lobga Rangzen, saying that the subject had been used to generate AI-assisted content and narratives, alongside an increase in cyberattacks attributed to China-linked actors. They cautioned that attackers could increasingly exploit politically sensitive developments and issues concerning the Tibetan community to generate targeted content and facilitate digital operations.
Gyal drew attention to a recent threat intelligence report by Anthropic, “Detecting and countering misuse of AI: September 2026,” which documented how China-based, government-aligned actors had used artificial intelligence to conduct surveillance and intelligence-gathering activities targeting the Tibetan community.
Thayai further noted that China is among the world’s major investors in artificial intelligence, following the United States, and warned that such technological capabilities could also be weaponised for surveillance and cyber operations. He urged Tibetan individuals and, particularly, non-governmental organisations to exercise greater caution when using AI-powered tools, stressing the importance of understanding their privacy policies, data-handling practices and potential security risks.
He cautioned that information entered into AI platforms could be processed or retained in ways users might not fully understand, raising concerns about the exposure of confidential material. Organisations, he said, should carefully assess whether AI tools can be trusted with sensitive information, establish clear internal AI-use policies and ensure that staff are adequately informed about the risks before sharing confidential data.
As the investigation continues, the extent of the breach, the identity of the attackers and the possibility of sensitive information being compromised remain unresolved. The incident highlights the growing cybersecurity challenges confronting Tibetan organisations, particularly those engaged in human rights documentation, research and advocacy.
TCHRD Director Tenzin Dawa told Phayul that the latest cyberattack underscored what she described as the Chinese party-state’s escalating efforts to suppress independent reporting on Tibet and restrict the organisation’s reach to international audiences.
She said the website’s inaccessibility had disrupted TCHRD’s ability to make its human rights documentation available to researchers, partner organisations and other stakeholders. Since Friday, several partners and researchers had contacted the organisation seeking to reference its documentation in their publications and on their websites but were unable to access the material while the website remained offline.
Dawa further pointed to website analytics from the past two years, which showed that China accounted for the highest number of active users, despite the country’s stringent censorship of information concerning human rights in occupied Tibet.
She alleged that the attack was aimed at preventing TCHRD’s reporting from reaching the international community, but maintained that repeated cyberattacks would not deter the organisation from its work. “We will ensure the world continues to see the reality inside Tibet,” she said.
