Iranian hacker group targets Israeli kindergartens in broad attack against Israeli security industry

Israeli kindergartens and other educational institutions reported on Sunday a cyber-attack affecting push-button public address systems used to broadcast alerts and messages. 

The affected systems were used to broadcast rocket alert sirens, Arabic messages, and songs in Arabic supporting terror attacks. 

The security breach reportedly targeted interfaces from a specific company called Maager-Tec, in at least 20 institutions in the country. The interfaces are responsible for broadcasting emergency messages at the institutions. 

According to the National Cyber Directorate, several reports were received in the morning hours regarding the hacking of the push button systems installed in a number of kindergartens. The Cyber Directorate investigation revealed that a hacker group had hacked into the interface of the private company that provides the buttons. 

In addition, tens of thousands of citizens received text messages with messages of intimidation from the hacker group on their cell phones, the National Cyber Directorate said. 

The National Cyber Directorate released a message saying it was "dealing with the issue and is in contact with the Ministry of Education. Citizens who received text messages are asked to block the sender and ignore the message, it should be clarified that it does not cause damage to the phone.” 

The Iranian hacker group Handala claimed responsibility for the hack, as part of a series of efforts to compromise Israeli systems, including defense and security affiliated organizations. 

At the same time, the Iranian group claimed to have also hacked into computer systems of the Ministry of National Security, stealing files containing information about police and security officers. According to footage distributed by the hacker group, the hackers managed to get documentation of firearm licenses and details of vehicles belonging to the municipal police departments. 

The Ministry of National Security and the National Cyber Directorate reported that no unusual findings were detected in the systems, and noted comprehensive examinations were being conducted in accordance with procedures. 

"The Handala Group’s claims are being handled professionally by the Ministry of National Security in cooperation with the government’s defense unit, the National Cyber Directorate and other experts,” the Ministry announced. 

Iranian hacker groups, including some believed to have government backing from the Iranian regime, have targeted Israeli infrastructure, companies, and even individuals in the past few years, with a marked uptick following the start of the Oct. 7, 2023, Gaza War. 

The Handala group has carried out several such attacks since the start of the war. 

Over the past few days, the group has claimed to have hacked secure government servers, including some belonging to Mossad-affiliated companies or belonging to the Ministry of Defense. The group’s claims have not been verified by the Israeli government, although the Handala group has released pictures and records which appear to be related to Israeli defense companies.