In early February, Iranian hackers released tens of thousands of documents stolen from Israel Police, the Ministry of National Security, and private Israeli security firms, Haaretz reported on Sunday. The leaked data included extensive personal details of armed security guards and the locations of weapons storage rooms in public institutions.
Handala, an Iranian cyber group linked to Iran’s Ministry of Intelligence (MOIS), claimed responsibility for hacking the Ministry of National Security’s systems. The group released several screenshots of gun licenses and threatened to release 4 terabytes of data. In February, it followed through with a much smaller release, publishing around 40 gigabytes of files.
In January, Handala targeted kindergartens in Israel, disrupting public address systems and infiltrating emergency systems in at least 20 locations by exploiting vulnerabilities in a private company’s infrastructure.
A cyberattack attributed to the Iranian hacker group Handala targeted kindergartens in Israel on Sunday, disrupting public address (PA) systems to broadcast what Israeli media described as pro-terrorism songs and red alert warnings. pic.twitter.com/PF3qRvU1pV
— Iran International English (@IranIntl_En) January 26, 2025
The leaked gun owners’ data contain the identities and addresses of thousands of Israelis with readily accessible weapons. This concentration of information puts exposed individuals at risk, as criminal or terrorist groups seeking weapons could potentially target them.
Hours after the leak was made public, the police firmly denied that the information had come from their systems: “Following a thorough investigation, we have determined that no external party accessed the police’s information systems. There is no indication of a breach or data leak from police databases.”
The leaked files, totaling over one hundred thousand, originate from various sources, including the Security and Licensing Division of the police, the Firearms Licensing Division of the Ministry of National Security, and private security firms. The Licensing Division is currently under investigation by the special police unit Lahav 433 for allegedly issuing firearm licenses without proper authorization. As part of the probe, employees from the office of former National Security Minister Itamar Ben-Gvir, as well as staff from the Licensing Division, have been questioned.
The leaked files are very recent, spanning the past two years, and include hundreds of documents from 2025. Sensitive details can be found among the records related to firearm license applications and renewals, including the gun owner’s identity, address, photograph, military and medical history, firearm type, the number of bullets in their possession, and whether the weapon is stored at home.
The hacked files also include a wealth of personal information about armed security guards, detailing their training, weapons licenses, and internal documents from security and protection companies. Additionally, the files contain permits for conducting shooting refresher courses on behalf of various licensed shooting ranges.
Since the outbreak of the Gaza war, Israel has been facing an unprecedented wave of cyberattacks. The National Cyber Directorate’s 2024 summary report highlighted a significant rise in leaks and attacks tied to influence operations. The report noted, “This year, 900 publications were observed on platforms like Telegram, targeting the Israeli economy, and 500 leaked information files related to Israel were published online and on the darknet. These publications are part of the enemy’s efforts to shape public perception in Israel.”
