Iran-linked hacker group claims to breach data of Israel’s largest healthcare network

A hacker group linked to Iran said on Wednesday that it had infiltrated the files of Israel’s largest healthcare network, Clalit, the group’s latest breach of Israeli systems.

Handala posted on social media that it had “released the sensitive medical data of more than 10,000 patients from this organization.” It said the hack had “delivered a devastating blow to the core of the Zionist regime’s healthcare system.”

“You boast of possessing the most advanced technologies, yet now you helplessly witness the collapse of your security walls,” the group wrote, echoing statements it has made about past hacks of Israeli data.

It added, “We proudly declare that our action is a legitimate response to decades of occupation, oppression, and human rights violations by the Zionist regime.”

Attached to the post were medical records, apparently from Clalit’s database and containing the names and personal information of Israeli patients. The records detail medical screenings and tests.

On Tuesday, the hacker group’s X account had posted the cryptic message, “Sometimes you can feel tomorrow before it arrives… It doesn’t seem like a good day for the guardians of health.”

The apparent hack is one of many Iran-linked espionage efforts within Israel. Politicians’ data has been hacked, and the Iranian regime has made extensive efforts to recruit spies in Israel via text messages and offers of cash payments.

Clalit’s website says that it serves 4.8 million Israelis, approximately half the country. In response to the hackers’ claims, Clalit said its cybersecurity specialists were investigating, that it had notified the government and that its systems were running normally.

“Upon receipt of the report, monitoring and response mechanisms were activated, and proactive preventative measures were taken to strengthen defense, alongside a professional and comprehensive investigation of the information that was publicized, and its extent,” the organization said in a statement reported by Hebrew media.

The hack is far from the first time Handala has boasted of accessing sensitive Israeli data. It occurred at a time when tensions are rising between Jerusalem and Tehran, as US President Donald Trump has threatened to attack Iran and Iran has vowed to retaliate by striking Israel.

“Against the backdrop of previous security tensions with Iran, [Handala] has shifted into a higher gear,” Gil Messing, chief of staff at the Israeli cybersecurity firm Check Point, told the Ynet news outlet. “Based on past experience, this is a group that is somewhat, though not fully, credible. Generally, when they say they have done something, it means something has happened, but not to the extent that they describe, so there’s a level of exaggeration.”

In December, Handala said it had hacked the phone of former prime minister Naftali Bennett, who is considered the most credible challenger to the current premier, Benjamin Netanyahu, in this year’s elections.

Bennett’s office acknowledged that his account on the messaging platform Telegram had been infiltrated, but said his phone hadn’t been breached.

Images, contacts and other information claimed by the group to have been obtained from Bennett’s phone were published on a website alleged to be run by Handala, and a link to download what it claimed was his list of phone contacts was shared by the account @Handala_Red on X. There was no way to confirm that the account and the website were run by the group claiming to have hacked the former prime minister’s phone.

Later, the group also said it had hacked the phones of Ayelet Shaked, a former cabinet minister and close Bennett ally, and Tzachi Braverman, Netanyahu’s chief of staff.

Other Iran-linked hackers have also targeted the Israeli health care system. Last October, over the holiday of Yom Kippur, the Assaf Harofeh Medical Center was hit with an attack by Qilin, a Russian-speaking cybercrime organization thought to be based in Eastern Europe. The group threatened to publish patient data unless it received a ransom of $70,000.

Weeks later, the government said Iran was behind that attack.