A group of Iranian-linked hackers on Thursday claimed to have released a new batch of private messages attributed to former prime minister Naftali Bennett, escalating an ongoing cyber affair that Bennett acknowledged a day earlier involved unauthorized access to his Telegram account.
The group, calling itself Handala, said it was publishing roughly 200,000 messages allegedly taken from Bennett’s communications. In an online statement, the hackers accused Bennett of lying about the breach and alleged, without providing evidence, that documents show he intended to use the military to seize power.
However, cybersecurity experts in Israel said the purported “new” release does not appear to contain additional material. After examining the files, analysts said the data matches content published a day earlier and appears to have been repackaged in a different format — released Thursday as PDF files after initially being published as HTML.
Israeli officials have not confirmed the authenticity of the newly circulated files, and Bennett has not publicly responded to the hackers’ latest claims.
The announcement followed Bennett’s acknowledgment Wednesday that hackers had gained access to his Telegram account, after he initially denied any breach. His office later clarified that while Bennett’s phone itself had not been hacked, access was obtained “through other means,” allowing attackers to extract contact lists, images and chat data. The statement said some of the leaked materials were authentic while others had been manipulated or fabricated.
Bennett said the matter was being handled by Israel’s security authorities and described the leak as a criminal act intended to harm him politically. He said Israel’s adversaries were seeking to prevent his possible return to office.
Earlier disclosures by the hackers included thousands of phone numbers and chat logs attributed to Bennett and his associates, including Israeli officials, journalists and foreign leaders. Cybersecurity specialists said the breach likely occurred through a computer used to back up Bennett’s phone rather than the device itself.
Handala has dubbed the operation “Operation Octopus,” mocking Bennett’s long-standing calls to confront Iran’s regional network of influence. The group has claimed ties to Iran’s intelligence apparatus, though Israeli authorities have not publicly confirmed that affiliation.
The incident has drawn added attention after Bennett warned just last week of a potential Iranian cyber onslaught against Israel, calling for a national “cyber Iron Dome” to protect critical infrastructure.
Israeli security agencies have not commented publicly on the scope of the breach or on the hackers’ allegations as the investigation continues.