Bennett admits Iranian hackers accessed his Telegram, says phone not breached

The ‘Handala’ hackers’ group claims it breached ex-prime minister’s phone in ‘Operation Octopus,’ publishes images, contact list and documents it says were on the device

After an earlier denial, the office of former prime minister Naftali Bennett acknowledged Wednesday that while his cellphone itself was not hacked, unauthorized access was gained to his Telegram account, following claims by an Iran-linked hacker group that it had breached his device.

Images, contacts and other information claimed by the group to have been obtained from Bennett’s phone were published on a website alleged to be run by the Handala hacker group, and a link to download what it claimed was his list of phone contacts was shared by the account @Handala_Red on X. There was no way to confirm that the account and the website were run by the group claiming to have hacked the former prime minister’s phone.

The group also claimed to have left a message on Bennett’s phone, which was published on the website alleged to be linked to the group.

“Dear Naftali Bennett,” it read. “You once prided yourself on being a beacon of cybersecurity, parading your expertise before the world. Yet, how ironic that your own iPhone 13 has fallen so easily to the hands of Handala. For all your boasts and bravado, your digital fortress was nothing more than a paper wall waiting to be breached.”

“Consider this a warning and a lesson,” the message continued. “If your personal device can be compromised so effortlessly, imagine the vulnerabilities that lurk within the systems you once claimed to protect. Next time you preach about security, remember: those who live in glass houses shouldn’t throw stones.”

“Welcome to a new era, where your secrets are only as safe as your weakest password,” it concluded.

The reference to Bennett as a “beacon of cybersecurity” likely referred to his start-up ventures in the years before he turned to politics, when he co-founded the device protection software developer Soluto and the online security company Cyota, later acquired by US network security company RSA Security.

The name of the hack, “Operation Octopus,” also appeared to be a direct reference to Bennett, who has frequently compared Iran to an octopus, with the Islamic Republic’s proxy groups being the tentacles.

Along with the message and the list of contacts, Handala published various images of Bennett with his family and at public events, as well as photos of several official letters that it claimed he had sent and received.

Bennett, who served as prime minister from June 2021 to June 2022, is seen as the most credible challenger to Prime Minister Benjamin Netanyahu in next year’s elections.

On Wednesday evening, his office initially rejected Handala’s claim entirely, saying that “following tests that we conducted, it has been determined that former prime minister Naftali Bennett’s phone wasn’t hacked.”

However, in a later statement released by his office, Bennett admitted that his Telegram account was hacked, and said the matter is being handled by security authorities and accused Israel’s enemies of trying to undermine his return to politics.

“Israel’s enemies will do everything to prevent me from becoming prime minister again. It won’t help them,” he said, vowing to continue “acting and fighting for the State of Israel and the people of Israel.”

According to Bennett, further checks found that although his phone was not compromised, hackers accessed his Telegram account “through various means.”

Content from his contact list, along with images and chats — some authentic and others fabricated — had been unlawfully obtained and circulated, he said. Bennett cited as an example a fake image showing him alongside Israel’s founding prime minister, David Ben-Gurion.

“The materials were obtained illegally, and their distribution constitutes a criminal offense,” Bennett said.