Inside the alleged hack of Naftali Bennett: Telegram breach or phone compromise?
Disputed leaks, AI images, and unanswered questions surround Handala’s claims.
The Iranian hacker group Handala claims it has hacked the smartphone of former Israeli prime minister Naftali Bennett, publishing what it says are contact lists, photos and videos, voice messages, and other data extracted from his device. Bennett has denied that his phone was compromised, saying instead that only his Telegram account was breached. In response, the hackers published what they described as 1,900 chat conversations that were “extracted directly from the device.”
On Wednesday evening, the group published a lengthy post on its official website, opening with a taunt directed at Bennett. “Dear Naftali Bennett,” wrote the Iranian hackers, who say they are affiliated with Iran’s Intelligence Ministry, “you once boasted of being a beacon of cybersecurity and presented your expertise to the world. And yet, how ironic that your iPhone 13 fell so easily into the hands of Handala. Despite all your bragging and pride, your digital fortress was nothing more than a paper wall waiting to be breached.”
The published materials include summaries of instant messaging conversations attributed to Bennett, along with a contact list containing phone numbers of senior figures in Israeli politics, culture, media, and business, including current and former members of Knesset, ambassadors, journalists, scientists, and executives. The hackers also released photos allegedly taken from Bennett’s device or accounts, including images of meetings with citizens and public figures, as well as videos and photos of personal letters they claim he wrote.
Bennett responded by reiterating that his phone itself was not hacked and that some of the circulated content was fabricated. He appeared to be referring, among other things, to an AI-generated image of him alongside David Ben-Gurion that the hackers published as part of the leak.
In an attempt to counter Bennett’s claims, Handala subsequently released what it described as all 1,900 chat conversations, asserting that they were taken “directly from the device” in order to “prove beyond any doubt” that his statements were false. “The evidence is clear and undeniable,” the group wrote. “Bennett’s attempt to mislead the public has failed. We invite everyone to examine the chats and judge for themselves who is telling the truth.”
However, a closer review suggests that what was actually published consists primarily of contact cards from instant messaging platforms, rather than full chat histories. This detail appears to strengthen Bennett’s claim that the breach was limited to his Telegram account, rather than a full compromise of his smartphone.
