The cyberattack, attributed to the Iranian group "Handala Hack," involved the publication of resumes containing names, phone numbers, email addresses, and details of previous roles in the Israeli Air Force, intelligence units, and missile defense programs.

Haaretz reported that some of the leaked files referenced work in classified units such as Unit 8200 and Unit 81. These resumes also detailed technical expertise in cyber defense, drone operations, and guided weapons development—data that should have remained confidential.

The leak is believed to have stemmed from a breach of the Israeli job platform “JobInfo” or one of its affiliated service providers. The most recent documents date back to 2024, though the breach itself may have occurred earlier.

Political and Legal Repercussions Feared

The report raised concerns that individuals identified in the breach could face legal risks, especially when traveling abroad, due to their previous military roles. One cybersecurity researcher, whose information appeared in the leak, described the exposure as “deeply alarming.”

According to Haaretz, some of the individuals listed had previously worked for the Prime Minister’s Office and Ministry of Defense, or transitioned to private companies in sectors such as drone manufacturing, cybersecurity, and intelligence software development.

Cyber experts described the operation as part of a broader Iranian campaign targeting over 20 Israeli-linked institutions in recent weeks. The leak, they said, reveals critical weaknesses in how military-affiliated professionals manage their career transitions into the private sector.