On April 9, an Iran-linked hacking group, Handala, announced it had compromised the personal devices of former Israeli Chief of Staff Herzi Halevi and released what it claimed to be over 19,000 classified photos and videos of classified military missions.
🇮🇷 🇮🇱 O grupo de hackers iranianos Handala invadiu o celular do ex-chefe das Forças Armadas de Israel, Herzi Halevi, divulgando inúmeras fotos pessoais.https://t.co/Z17MSEaURA pic.twitter.com/8EXS12Un96
— Ali Ramos Abdul Hakam – Canal Vento Leste (@Ali_Ramos_Hakam) April 9, 2026
Some of the leaked content includes personal photos and pictures of a meeting between Halevi and former United States Central Command commander Michael Kurilla at Qatar.
“Over all this period, over 19,000 secret photos and videos of the most secret conferences of the Chief of Staff of the Zionist military have been smuggled out and stored, of which your top generals never hoped to hear anything.”
The group said on its website that “Handala was and had been, invisibly, right up inside the system of General Herzi Halevi, the former Chief of Staff of the Zionist Army, a place nobody would ever guess to exist. Over all this period, over 19,000 secret photos and videos of the most secretive discussions of the Chief of Staff of the Zionist military have been smuggled and stored away, something your best generals never thought would ever see the light of day.”
The hacker group boasted that their “access to high-ranking Israeli commanders and facilities remains open and active to this day, and that an army that now pixelates all its publicly available photographs has never realised that the files and photos of its own Chief of Staff were accessible and uncensored to Handala at all times and over several years.”
“All the faces, all the commanders, all the criminal pilots, clear and unblurred, are in our hands, and will be shown, one at a time, at the right moment.”
The group claimed that they still have access to crisis rooms, maps and command centre information, but they have yet to reveal the full scope of material that is compromised.
In January 2025, Halevi stepped down as the IDF chief of staff. He was succeeded by Lt. General Eyal Zamir. The release has not received a comment from the IDF.
It is not the first occasion that Handala has attacked top Israeli officials. The group was originally known as the Ehud Barak Group, named after former Prime Minister Ehud Barak, and has already leaked 110,000 emails of former Prime Minister Ehud Barak, 60,000 emails of a former IDF chief of staff, and boasted of having accessed documents in the security systems of the Shin Bet with information about approximately 30,000 officers.
Handala is not an independent hacktivist group, but a front of the Ministry of Intelligence and Security (MOIS) of Iran, according to the evaluation of the US Justice Department. According to the FBI, the group is operated by a MOIS unit that is also involved in other Iranian intelligence personalities. Yahya Hosseini Panjaki, who was killed in the 2026 war in Iran, was the head of the cyberunit of the group.
In the ongoing conflict, Handala perpetrated a devastating wiper attack on the US medical technology company, Stryker Corporation, with Microsoft Intune, and was termed as the biggest wartime cyberattack on the United States. Two of its most prominent representatives were killed in the war, and this forced the group to reorganise.
