The US, Israel-Iran war has largely played out in the skies, with missiles and drones hitting military bases and critical infrastructure. Yet the conflict is not confined to the battlefield. It is also being fought in cyberspace.
Hackers and cyber groups aligned with rival sides have increasingly begun targeting companies, government systems and individuals linked to the national security apparatus. Data leaks, website breaches and online intimidation campaigns have become tools in this digital confrontation.
In the latest such claim, the hacking group Handala has taken responsibility for cyber intrusions targeting American and Israeli entities in two separate incidents, releasing alleged data and issuing threats against officials in recent days.
As the war between the United States and Iran continues, the group claimed it had targeted the American medical device manufacturer Stryker. In a Monday post on its official website, the hackers said they wiped approximately 12,000 terabytes of data by attacking nearly 200,000 systems.
Responding to the incident, the company confirmed it has been facing a global disruption since March 11 due to a cyberattack. In a statement, Stryker said, “We experienced a cybersecurity attack which resulted in a global disruption to Stryker’s Microsoft environment.”
The group’s claim about the scale of the data wiped could not be independently verified.
In another cyber incident in Israel claimed by the group, data posted on the hackers’ website allegedly contained emails, private chats and personal details of Laura Gilinski, Deputy Director of the Institute for National Security Studies (INSS), an Israeli security and strategic affairs think tank.
The group also claimed it had accessed 100,000 classified emails linked to her. According to the hackers, Gilinski previously served as Deputy Head of Planning and Strategy in Mossad, Israel’s intelligence agency. The authenticity of the leaked material could not be independently verified.
The hackers also claimed to have targeted Sima Shine, a senior researcher at INSS and former director of the institute’s research programme “Iran and the Shiite Axis,” who previously served in Israeli intelligence. In posts on X, the group repeatedly challenged Mossad, suggesting that members of Israel’s intelligence community remain one of its primary targets.
Who are the Handala hackers?
According to Israel-based research group International Institute for Counter-Terrorism (ICT), the Handala Hack Team (HHT) emerged around December 2023 following the escalation of the Israel–Hamas war. Researchers say the group has primarily targeted Israeli political figures, defence personnel and organisations linked to critical infrastructure.
The group has been targeting Israeli entities for more than a year. The ICT estimates that at least 85 cyberattacks were carried out between February 2024 and February 2025, the majority aimed at Israeli targets, with a few incidents also reported in the United States.
Their operations typically involve DDoS attacks, phishing campaigns and hack-and-leak data releases, tactics commonly used by hacktivist groups to disrupt systems while amplifying political messaging online.
HHT operates through messaging platforms such as Telegram, X and dedicated leak websites to publish announcements of alleged breaches and distribute hacked datasets. The group’s current Telegram channel has 2,346 subscribers, while its X account has 1,463 followers and around 40 posts.
The group has repeatedly faced suspensions online. According to its own posts, the current Telegram channel is its 41st channel, after several previous channels were taken down. Similarly, multiple X profiles linked to the group have also been suspended, after which new accounts were created.
In its Telegram channel, the group has also posted calls for action, inviting supporters willing to take action against Israel, offering what it described as financial and informational support for participants.
