Cyberattacks Surge Ahead of Israeli Elections, Targeting Voting Day
Translated & summarized from Calcalist by baba
Cyberattacks against Israeli organizations and government bodies have surged by tens of percent in the weeks leading up to elections, with planned disruptions for election day. Check Point reported a 55% increase in weekly attacks on organizations and an 82% rise on government entities. Iranian and other anti-Israeli groups are publishing stolen data, and phishing sites impersonating election services are active. Discussions on the dark web reveal plans to take down key government websites on election day.
The story in 6 lines · by baba
- Cyberattacks on Israeli organizations rose 55% to 2,700 weekly attempts in early October.
- Attacks on Israeli government bodies increased 82% to 2,300 weekly attempts.
- The energy and infrastructure sector saw a 107% rise in weekly cyberattack attempts.
- Iranian and other anti-Israeli groups are publishing stolen data linked to elections.
- Over 1,200 election-related websites were created, with 25 suspected of malicious intent.
- Dark web discussions reveal plans to disrupt key Israeli government websites on election day.
In the weeks leading up to Israel's elections, a significant surge in cyberattacks targeting companies and local government bodies has been recorded, with organized efforts aimed at disrupting leading Israeli websites on election day itself. According to data released by the Israeli company Check Point, while Israel is consistently a target for state-sponsored actors like Iran and independent ideological groups, the election period has seen a substantial increase in attack volume.
Check Point reported that in the initial weeks of October, Israeli organizations faced an average of 2,700 weekly cyberattack attempts, a 55% rise compared to the same period in 2025. The government sector experienced an average of 2,300 weekly attack attempts per entity, an 82% increase. The energy and infrastructure sector saw the highest jump, with a 107% increase to an average of 3,900 weekly attempts. Of these, Check Point identified 87 successful attacks since early October, mostly resulting in website outages or defacement.
Furthermore, the past ten days have shown a marked increase in public activity by anti-Israeli attack groups, including Iranian entities, who are publishing materials allegedly obtained from cyberattacks. These materials include videos, images, and files related to Israeli public figures, IDF bases, public officials' communications, and databases of personal information. The Iranian group Handala has significantly increased its publication rate, directly linking its activities to the Israeli elections. Analysis indicates that 53% of these incidents are attributed to pro-Palestinian hacktivists, 18% to Indonesian hacktivists, and 10% to criminal elements.
Phishing attacks have also adapted to the election period. Check Point noted that 1,200 election-related websites were created in September and October, with 25 suspected of malicious intent. One example involved a message impersonating a 'voter information service' that requested recipients to verify details, leading to a malicious site that stole entered information like ID numbers and addresses. Significant discussion has also been observed on the dark web regarding election-related plans, with a 110% increase in attack group discussions in October compared to September. These discussions include plans to take down prominent websites on election day, such as the Prime Minister's Office, the Knesset, the Israel Police, the Ministry of Foreign Affairs, the Bank of Israel, and the Likud party website, using denial-of-service attacks. Additionally, a database claimed to contain 6.5 million voter records is reportedly being offered for sale.
Sivan Dror, Research Director at Check Point, stated that the days surrounding elections are critical, allowing threat actors to leverage public attention to amplify their impact. She advised organizations to ensure official websites and accounts are protected and prepared for rapid response, while the public should rely on official election channels, avoid submitting personal details through links in messages requesting updates, and verify information before sharing.
