Crime

By Pesach Benson • October 22, 2025

Jerusalem, 22 October, 2025 (TPS-IL) — Israel has confirmed that Iran was behind a cyberattack on a hospital three weeks ago, in what officials described as part of a broader wave of Iranian attempts to target Israeli infrastructure and companies.

Israel’s National Cyber Directorate said on Wednesday that Iran was behind a cyberattack on the Shamir Medical Center in Beer Yaakov during the recent Yom Kippur holiday.

The attack involved both a data breach and an attempt to disrupt hospital operations. While attackers managed to leak medical information, the directorate stressed that no medical services were harmed and the breach was contained swiftly.

“At Shamir hospital, beyond the data leak itself, the attempt to harm a hospital in Israel crosses a red line that could have endangered human life,” said Yossi Karadi, head of the National Cyber Directorate.

Initially, a ransomware group from Eastern Europe claimed responsibility, posting an extortion demand with a 72-hour deadline. However, Israeli authorities later determined that Iranian actors orchestrated the operation. Officials said the incident was linked to a larger campaign targeting Israeli companies and critical service providers in recent weeks. More than ten private firms have faced cyberattacks, often exploiting vulnerabilities in digital service providers within supply chains.

Investigations revealed that in many cases, hackers gained access using stolen or leaked usernames and passwords. Most attacks did not disrupt operations, though some resulted in data leaks. Authorities warned that the damage could have been far more severe without a coordinated response involving the National Cyber Directorate, the Shin Bet security agency, government ministries, and the Israel Defense Forces.

“Thanks to close cooperation, rapid information sharing, and a targeted response, the incidents were contained quickly and efficiently, preventing broader harm to Israel’s economy,” Karadi said.

Officials noted that the Shamir hack was traced to a vulnerability in a personal laptop belonging to a support employee at a cybersecurity firm. Despite this, the hospital’s daily activities continued without disruption.

Since the start of 2025, Israel has thwarted dozens of Iranian cyberattacks targeting prominent civilians, including security officials, politicians, academics, journalists, and media professionals. The Shin Bet security agency said these operations aim to collect sensitive personal data that could later be used in physical attacks within Israel, potentially carried out by locally recruited operatives.