Former PM Bennett acknowledges Iranian hack but says only Telegram account, not phone, was breached

After the Iranian hacker group Handala claimed on Wednesday to have hacked former Prime Minister Naftali Bennett’s phone as part of a hacking campaign it called “Operation Octopus,” Bennett admitted on Thursday that his Telegram social media account had been compromised. 

Initially, Handala claimed to have hacked Bennett’s phone, posting details about the phone, including his phone number to the group’s 𝕏 account. 

“Dear Naftali Bennett, You once prided yourself on being a beacon of cybersecurity, parading your expertise before the world,” the group wrote, announcing the hack. “Yet, how ironic that your own iPhone 13 has fallen so easily to the hands of Handala. For all your boasts and bravado, your digital fortress was nothing more than a paper wall waiting to be breached.” 

“Consider this a warning and a lesson. If your personal device can be  compromised so effortlessly, imagine the vulnerabilities that lurk within the systems you once claimed to protect,” the message continued. “Next time you preach about security, remember: those who live in glass houses shouldn’t throw stones.” 

Alongside the message to Bennett, the group also posted pictures, videos, and documents, which it claimed were taken from Bennett’s phone, which contained sensitive materials, including a list of contacts with the phone numbers of senior political officials, screenshots of Bennett's correspondence, and personal photos of his family members, as well as political and public figures. 

After the messages alleging the hacking were released, Bennett said he had his phone evaluated by security experts, and his office later released a statement that his phone had not been hacked, rather his Telegram social media account had been compromised. 

Bennett said that some of the documents and pictures shared are fake, pointing to an AI-generated image which showed Bennett standing with Israel’s first prime minister, David Ben Gurion. 

On Thursday morning, thousands of Israelis, including some of those on the contact list from Bennett’s Telegram account, received text messages saying, “Iranian intelligence agencies are ready to receive your intelligence cooperation. To cooperate, contact one of the Iranian embassies via the Internet.” 

גל תחושות קנאה וקיפוח בקרב מי שלא קיבלו את המסר שהגיע הבוקר לישראלים רבים מ״סוכנויות מודיעין איראניות״ ולפיכך אינם נחשבים לסגל א׳, או לפחות ב׳ כמו בנט. חיוג למספרו של השולח מניב הודעה מוקלטת, סתמית, באנגלית. pic.twitter.com/xymUZwbKyj

— אמיר אורן - Amir Oren (@Rimanero) December 18, 2025

The National Cyber Directorate warned Israelis not to call the number used to contact them, not to click on any shared links, and to block the contacts. Defense officials also warned Israelis not to click on the links provided by the group on their social media accounts. 

When trying to access the links from within Israel, a message pops up on the user’s browser, saying the link could contain malicious code, and warning not to proceed. 

Before Bennett returned to politics, joining the previous broad coalition government, he co-founded a device protection software developer, called Soluto, and an online security company, called Cyota. Both organizations were later acquired by a U.S. cyber security company.