Cyberattacks on Israeli organizations surge ahead of elections, Check Point warns
Attacks against government organizations rose 82% in early October, while those targeting energy and infrastructure more than doubled. Check Point also identified suspected plans to disrupt major websites on election day and phishing campaigns seeking voters’ personal information.
Cyberattacks targeting Israeli organizations have surged in the weeks leading up to the country’s elections, with attacks against government entities rising 82% and those targeting energy and infrastructure increasing 107%. At the same time, hackers are discussing plans to disrupt major Israeli websites on election day, while phishing campaigns seek to steal voters’ personal information, according to findings published Sunday by Israeli cybersecurity company Check Point.
Israel is a frequent target of cyberattacks, ranging from state-sponsored operations, including those attributed to Iran, to ideologically motivated hacktivist groups. But the election period has brought a significant increase in attacks, alongside growing activity by threat groups on Telegram channels, forums and the dark web, according to Check Point.
During the first weeks of October, organizations in Israel faced an average of 2,700 cyberattacks per week, a 55% increase from the same period in 2025. The government sector recorded approximately 2,300 attacks per week, up 82% year over year. The steepest increase was in the energy and infrastructure sector, where attacks rose 107% to an average of 3,900 per week.
Check Point said it had verified approximately 87 cyberattacks against Israel since the beginning of October, most of which sought to take websites offline or deface them.
The company also reported a marked increase over the past 10 days in public activity by anti-Israeli threat groups publishing material they claim to have obtained through cyberattacks. The material reportedly includes videos, images and files relating to individuals in Israel, Israeli military bases, correspondence involving public officials and databases containing personal information.
Check Point singled out the Iranian group Handala, which it said had significantly increased the frequency of its publications, explicitly linking them to the Israeli elections. According to the company's analysis, 53% of the incidents were attributed to pro-Palestinian hacktivists, 18% to Indonesian hacktivists and 10% to criminal actors.
Phishing campaigns are also exploiting the election period. Check Point said more than 1,200 election-related websites were registered during September and October, with approximately one in every 47 suspected of being malicious.
In one example identified by the company, a phishing message impersonating a “Voter Information System” asked recipients to verify their personal details. The “Verify my details” button led to a malicious website designed to steal the information entered, including identity card numbers, names, residential addresses and email addresses.
Check Point also identified a sharp increase in election-related discussions on the dark web. Since the beginning of October, discussions about the elections and Israel among threat groups have risen 110% compared with September, the company said.
Some groups are reportedly preparing to disrupt prominent Israeli websites on election day through denial-of-service (DoS) attacks, which seek to make online services unavailable by overwhelming them with traffic. Websites mentioned in these discussions include those of the Prime Minister’s Office, the Knesset, the Israel Police, the Foreign Ministry and the Bank of Israel. A call to attack the website of the Yashar party was also published.
A database purportedly containing records on 6.5 million Israeli voters is being offered for sale again on the dark web, according to Check Point. The database had previously been leaked, and some hackers claim to have purchased it. The company warned that such information could be used to facilitate fraud or mislead voters, including through fake messages containing personal details and false claims about polling locations or eligibility to vote.
“The days surrounding the elections are a critical period when threat actors can exploit public attention to amplify their impact,” said Sivan Dror, director of research for exposure management at Check Point.
Dror urged organizations to protect their official websites and accounts and prepare to respond quickly to attacks. The company also advised the public to verify voting instructions through official channels, avoid entering personal information through unsolicited links, and check the source of information before sharing it.
Check Point recommended that organizations test their defenses against attacks that could disrupt website availability, enable multi-factor authentication for administrative and social media accounts, monitor for impersonation attempts and prepare alternative communication channels in case their services are disrupted.
The company also warned against acting on unusual requests to transfer information, money or access permissions without independently verifying them, even when a request appears to come from a senior executive through a voice or video message. As Dror put it, widespread circulation is not proof of credibility.
