Former prime minister Naftali Bennett acknowledged Wednesday that hackers gained access to his Telegram account, backing away from earlier denials after Iranian-linked hackers published thousands of phone numbers and private messages attributed to him and his associates.
Bennett initially said his mobile phone had not been hacked. Hours later, his office issued a revised statement conceding that while the device itself had not been breached, “access was obtained to the Telegram account through other means,” allowing hackers to extract contact lists, images and chats, some of them authentic and others allegedly fabricated.
“The matter is being handled by the relevant security authorities,” Bennett said in the statement. “Israel’s enemies will do everything to prevent me from becoming prime minister again. It will not help them. No one will stop me from acting and fighting for the State of Israel and the Jewish people.” He added that the materials were obtained illegally and that their dissemination constitutes a criminal offense.
The admission followed the release by a group calling itself “Handala,” which Israeli cyber experts have linked to Iran. The hackers published 141 pages of phone numbers — thousands of contacts in total — along with nearly 2,000 HTML files containing chat logs, many of them partial. The data includes phone numbers of Israeli security officials, journalists and public figures, as well as international leaders such as French President Emmanuel Macron, United Arab Emirates President Mohammed bin Zayed and Rafael Grossi, head of the International Atomic Energy Agency.
Cybersecurity specialists said the hackers likely gained access through a computer used to back up Bennett’s phone rather than the handset itself.
Among the leaked material were private exchanges between Bennett and aides and associates, some of which included disparaging remarks about political allies. In one exchange attributed to Bennett or a close associate during his tenure as prime minister, Avigdor Liberman, leader of the Yisrael Beytenu party, was described as appearing “drugged” in an interview. In another, former justice minister Ayelet Shaked was called “terrible,” and in a separate chat, a senior figure was quoted as saying “Benny was crap,” apparently referring to former defense minister Benny Gantz. It was not always clear who authored the comments.
Some chats included personal details. In one conversation, Bennett appeared to correspond with a young woman who volunteered for the IDF despite being exempt, commenting in part on her appearance. Speaking to ynet, the woman denied the authenticity of the messages. “I saw what they call a correspondence for the first time an hour ago,” she said. “These are things that never happened.” She suggested Bennett was being targeted and said she supported his leadership.
The hackers also published images, WhatsApp messages and internal group chats. One leaked message, allegedly written by Bennett’s spokesman during his premiership, Matan Sidi, appeared to say, “We need to insist with Dadi,” likely referring to Mossad chief David Barnea.
Handala dubbed the breach “Operation Octopus,” a reference to Bennett’s long-standing calls to strike what he has described as Iran’s “octopus” — its regional network of influence. Mocking Bennett, the group wrote that despite his reputation as a cybersecurity expert, his “digital fortress was nothing more than a paper wall waiting to be breached.”
The hackers claimed affiliation with Iran’s intelligence apparatus, though Israeli officials have not publicly confirmed that link.
The incident drew added attention because only a week earlier, Bennett warned at a cybersecurity conference at Tel Aviv University of an Iranian cyber doomsday scenario. “Imagine Iran secretly infiltrating Israel with a million cyber hackers,” he said, describing a future in which hospitals are shut down, bank savings erased and election results manipulated. He called for the creation of a national “cyber Iron Dome” to protect Israel.
Security authorities have not commented publicly on the scope of the breach or potential legal action as the investigation continues.
First published: 23:45, 12.17.25