Israel’s Bennett confirms Telegram account hacked but phone not breached
Former Israeli prime minister Naftali Bennett confirmed that his Telegram account was hacked but insisted his phone was not accessed, the Jerusalem Post reported on Wednesday.
Former Israeli prime minister Naftali Bennett confirmed that his Telegram account was hacked but insisted his phone was not accessed, the Jerusalem Post reported on Wednesday.
Bennett said in a statement that the device linked to the compromised account is no longer in use, according to the report.
Earlier in the day, the group, calling itself “Handala” and linked to Iran’s intelligence ministry, alleged it had hacked what it described as Bennett’s iPhone 13 as part of what it called “Operation Octopus.”
It went on to publish a link it said reveals a trove of private communications it extracted from his device.
The name appears to reference Bennett’s own long-standing description of Iran as “the head of the octopus,” with regional allied militant groups as its arms.
In an open letter, the group taunted Bennett, writing: “You once prided yourself on being a beacon of cybersecurity ... Yet, how ironic that your own iPhone 13 has fallen so easily to the hands of Handala.”
“Consider this a warning and a lesson. If your personal device can be compromised so effortlessly, imagine the vulnerabilities that lurk within the systems you once claimed to protect,” the group added.
Handala published a series of files on its website and Telegram channel that it said were taken from the compromised device.
The group claimed it had gained access to private correspondence and contact information, publishing what it said were phone numbers linked to Bennett and to Avia Sassi, whom it described as a close associate.
Handala further claimed that the materials included private chats spanning several years, covering political coordination, candidate selection and, later, security-related concerns following the October 7 attack by Hamas militants on Israel.
Before the statement by Bennett’s office was released, Israel Hayom reported that Bennett’s office initially told the paper that it was "unaware of such an event." According to the report, Bennett’s security team said the matter is being handled by Israeli security and cyber authorities, that the device in question is not currently in use.
The report quoted Shai Nahum, a cyber warfare expert who reviewed the materials released by the group, said the data was unlikely to have originated from Bennett’s personal phone.
"According to forensic analysis of the leaked files, there is a high probability that this is not Bennett's phone, but apparently that of one of his associates," Nahum said.
Handala's claim comes a day after the group said it was offering a $30,000 reward for information related to Israel’s military sector after releasing material it said identified people involved in designing Israeli missile defense systems.
Who is Handala?
Handala is widely described by cybersecurity researchers and Western officials as tied to Iran’s Ministry of Intelligence.
It derives its name from a character created by Palestinian cartoonist Naji al-Ali. A barefoot boy in patched trousers, Handala represented Palestinian dispossession.
Researchers say the group operates as part of a broader cyber unit known as Banished Kitten, also referred to as Storm-0842 or Dune, which they link to the ministry’s Domestic Security Directorate.
The group has been linked to cyber operations against Israeli infrastructure and public institutions for around two years.
In January, it claimed responsibility for a cyberattack on Israeli kindergartens that disrupted public address systems at about 20 locations. In August, the group was linked to hacks targeting multiple Israeli entities, including academic institutions, technology firms, media outlets and industrial companies.
Handala has also been linked to cyber operations targeting Iran International, a London-based Persian-language broadcaster.
