Iranian Hackers Expose Senior IDF Commander, Leak Data Endangering Top Officers -
Handala, a hacking group linked to Iranian intelligence, exposed the identity of the commander of the IDF's elite Yahalom combat engineering unit on Tuesday, leaking his schedule and photographs of him and his family, along with other sensitive military information that could put senior officers at risk.
The group leaked more than 300 megabytes of data across dozens of files and claims to possess hundreds more. The source of the leak remains unclear, but a Haaretz review found that the material contains genuine, up-to-date information.
Among the files published by Handala was information about events involving senior officers scheduled for this week, including an invitation to an event attended by Maj. Gen. Nadav Lotan, commander of the IDF Ground Forces. Precise intelligence about senior officers' whereabouts and schedules could assist hostile actors seeking to target them.
In recent years, Iran has stepped up efforts to recruit operatives inside Israel and carry out attacks against senior officials. In July, the Mossad announced that, working with the Shin Bet and foreign intelligence agencies, it had thwarted an infiltration attempt by terrorist cells into Israel. In April, the agency said it had foiled an Iranian plot targeting Israeli officials and an oil pipeline in Azerbaijan. U.S. President Donald Trump has also been a target of Iranian threats. In July, he was reportedly evacuated from Air Force One in secret amid concerns that Iran planned to attack the aircraft.
The leaked material also included the Yahalom commander's planned schedule for the coming month. Other files revealed robotic systems used by the Combat Engineering Corps, including some that had not previously been made public, as well as details about the unit's technology development and procurement processes.
The leak included photographs of the officer and his family. One image also revealed the identity of another senior IDF officer, a lieutenant colonel serving in the Combat Engineering Corps.
The source of the breach remains unknown. The presence of voice messages in the leaked material could indicate that the hackers gained access to the phones of IDF officers or soldiers, or to their cloud backups. Most of the files appear to be connected to the Combat Engineering Corps, while some seem to relate to the IDF Spokesperson's Unit.
The IDF said in a statement: "The matter is under thorough investigation and handling by all authorized parties."
Handala presents itself as a pro-Palestinian hacktivist group, but Israel and the United States have identified direct links between the group and the Iranian regime. In March, the U.S. Justice Department described Handala as a unit of Iranian intelligence responsible for psychological warfare and intimidation campaigns, claiming responsibility for cyberattacks, publishing stolen information, and targeting journalists, opponents of the Iranian regime and Israelis.
Throughout its operations, the group has sought to amplify the impact of its activities by combining information obtained through genuine breaches with publicly available material and fabricated or false claims.
This week, the Israeli news website Walla reported that Handala had published photographs and videos allegedly filmed at IDF bases and outposts. The group claimed that the footage was recorded by operatives who had infiltrated IDF units and remained active within the military. The videos were published without sound.
"Today, the Zionist army must face a bitter truth: Our infiltrators have not only completed their mission, but are still at the very heart of your army, marching right among your ranks, in briefing rooms, in headquarters, and even alongside senior commanders," Handala said in a statement.
The IDF has not yet responded to Haaretz's questions about the footage, meaning the group's claims cannot be definitively ruled out. However, a review of the videos suggests that they consist, at most, of very short clips filmed by soldiers during operational activity in northern Israel, likely within the past six months. The soldiers are likely to belong to the ultra-Orthodox Netzah Yehuda infantry battalion. The source of the footage remains unclear.