After a contentious city council vote, attackers deface the mayor's public website with political slogans but make no ransom demand. Which motivation and actor type best describe the activity?

Website defacement with political slogans after a contentious council vote, without a ransom demand, fits hacktivist motivation. Hacktivists pursue ideological or political messaging and visible disruption more than quiet profit. The absence of financial extortion and the presence of political content on a civic site are strong indicators that ideology and attention—not payroll—are the drivers.

Organized crime seeking direct financial gain through ransomware would typically encrypt systems or steal data and demand payment, not settle for slogan graffiti alone. Insider threat focused solely on quiet GIS exfiltration emphasizes stealthy data theft by trusted personnel, which contradicts noisy public defacement. Nation-state actors primarily collecting SCADA engineering drawings prioritize covert intelligence over spray-painting the mayor's homepage with slogans.

Exam caveat: motivation is inferred from objectives and methods—political messaging without extortion points to hacktivism. Operational check: harden public municipal web properties with WAF, least-privilege CMS accounts, rapid restore from clean builds, and communications plans that address political messaging incidents without confusing them for ransomware payment events; preserve evidence for attribution but restore citizen services quickly.