Iranian-Linked Hackers Leak Sensitive Data from Israel’s Largest Healthcare Provider A suspected cyberattack targeting Clalit Health Services, Israel’s largest health maintenance organization (HMO), has exposed thousands of sensitive documents, including patient records and internal communications. The breach was claimed by Handala, a hacking group with alleged ties to Iran, which published the stolen data online. The leaked files include medical referral forms (Form 17), sick leave certificates, test referrals, and HR correspondence, some containing personal details of patients and employees. The group asserted that the breach compromised data belonging to over 10,000 patients and warned of further disclosures. Clalit confirmed it is investigating the incident, which appears to be part of a broader trend of Iranian-linked cyber operations targeting Israeli critical infrastructure. The attack follows recent ransomware campaigns by other threat actors, including the Lazarus Group, which has adopted Medusa ransomware to extort healthcare and nonprofit organizations. The breach underscores the growing threat of state-aligned hacking groups exploiting healthcare data, raising concerns over patient privacy and operational disruptions in the sector. No ransom demand has been publicly disclosed, but the incident aligns with escalating cyber tensions in the region.

Hebrew media reported in May 2021 that Iranian hackers have targeted Veritas Logistics Israel and threatened to make consumer data public. The hacking group published documents related to firms using Portnox’s services, they exposed Bezeq, Elbit, El Al, the Clalit health provider, and more companies' data. The hacking gang infects its victims' networks with ransomware, which gives them access to data or systems, threatens to release business data, and then demands Bitcoins as a ransom payment. The ransom demand from the hackers was 3 bitcoin ($170,000). The National Cyber Directorate has warned that coordinated attacks against Israel and took preventive steps to stop such incidents.