Iran-linked hacking group Handala claimed on April 9 to have breached the personal devices of former Israeli Chief of Staff Herzi Halevi, publishing what it said were more than 19,000 confidential images and videos from secret military assignments.

Among the leaked content are personal images and photographs of a meeting between Halevi and former United States Central Command commander Michael Kurilla in Qatar.

"During all this time, more than 19,000 confidential images and videos from the most secret meetings of the Zionist military's Chief of Staff have been extracted and archived, material your top generals never dreamed would see the light of day."

"For years, Handala has silently and invisibly been right inside the system of General Herzi Halevi, the former Chief of Staff of the Zionist Army, a place no one ever imagined possible," the group stated on its website."During all this time, more than 19,000 confidential images and videos from the most secret meetings of the Zionist military's Chief of Staff have been extracted and archived, material your top generals never dreamed would see the light of day."

"An army that now nervously pixelates every public image never realised that its own Chief of Staff's files and photos have been fully accessible and uncensored to Handala, every moment, for years," the hacker group claimed, adding that they maintain ongoing access to senior Israeli commanders and facilities.

"Every face, every commander, every criminal pilot, clear and unblurred, is in our hands, and will be revealed one by one when the time is right."

The group asserted that crisis rooms, maps, and command centre details remain accessible to them, though they have not yet disclosed the full extent of compromised materials.

Halevi resigned as IDF chief of staff in January 2025. He was replaced by Lt. General  Eyal Zamir. The IDF has not publicly commented on the release.  

It is not the first time Handala has targeted senior Israeli officials. The group, which first appeared in December 2023, has previously leaked 110,000 emails from former Prime Minister Ehud Barak, 60,000 emails from a former IDF chief of staff, and claimed to have seized documents from the Shin Bet's security systems containing information on around 30,000 officers.

The US Justice Department has assessed Handala as a front for Iran's Ministry of Intelligence and Security (MOIS), not an independent hacktivist group. The FBI said the group is run by a MOIS unit also responsible for other Iranian intelligence personas. The group's cyberunit was led by Yahya Hosseini Panjaki, who was killed during the 2026 Iran war.

During the current conflict, Handala was responsible for a destructive wiper attack on US medical technology firm Stryker Corporation through Microsoft Intune, which was described as the most significant wartime cyberattack on the United States. The group was forced to reorganise after two of its most prominent figures were killed in the war.