Former Security Chief Charged with Hacking 26 Companies, Filming Women

A former information security manager has been indicted on charges of hacking into 26 companies, two kibbutzim, and private computers, allegedly stealing sensitive business data and recording individuals in their homes. Michael (Miki) Bar, from Ashkelon, who previously served as the information security manager for the Hamat Group, is accused of systematically developing and deploying malicious software since 2019. The indictment details how Bar allegedly used artificial intelligence tools, including Claude, to create sophisticated malware capable of stealing passwords, sensitive business information, and footage from cameras and microphones.

The charges reveal a complex scheme where Bar, upon learning his cyberattack was discovered, allegedly developed even more advanced malware to continue his data extraction. The indictment, filed by the State Prosecutor's Office Cyber Department, outlines 11 separate charges and attributes 28 counts of unauthorized computer access, 44 counts of introducing computer viruses, 155 counts of privacy violations, and multiple counts of theft and prohibited software operations to Bar. The estimated financial damage to the affected companies amounts to approximately NIS 1.5 million.

Notably, the investigation began when national cyber defense officials contacted Bar, suspecting his employer, the Hamat Group, was a victim of a widespread attack. Bar, however, was allegedly the perpetrator himself. He reportedly concealed his involvement for two weeks while continuing his malicious activities and even developing new malware to infiltrate additional companies. The prosecution is seeking his detention until the conclusion of legal proceedings, citing his dangerousness and the risk of evidence tampering.

The indictment further describes Bar's alleged intrusion into the private lives of individuals. He is accused of using computer cameras and microphones in homes, bedrooms, and hotel rooms to record people without their knowledge. Specific instances include filming a product manager sleeping in her bed and a business development executive in a hotel room, while also stealing her passwords, including access to her health fund account. He is also accused of filming the daughters of a sales agent in intimate situations and recording conversations within their home.

Bar's alleged methods included using Telegram bots to control malware, enabling actions like screen capture, audio and video recording, and the extraction of saved passwords and credit card details. He also allegedly developed advanced malware to spread within organizations, search for cryptocurrency wallets, and compromise defense systems. During his arrest, investigators reportedly found malware, control server links, and thousands of files on his computers, some sorted into folders containing stolen data. Bar initially claimed he acted under employer authority but later admitted to creating malware with AI, though he denied controlling the Telegram bots, alleging an unknown individual took over his account.