Israel Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Israel
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Israel, checked 7 Nov 2026. The INCD publishes no public cyber threat level and signals threat through statements by its director general Yossi Karadi and warnings to the public.
Source: Al-Monitor (Reuters)
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
| Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Hostile cyber incidents logged by the INCD | about 4,800 | June 2026 (about 1,600 in June 2025) | Al-Monitor (Reuters) |
| Calls to the INCD emergency line | 4,019 | War period to 24 March 2026 | Jerusalem Post |
| Average INCD intervention time | about 30 minutes (down from 6 hours 13 minutes) | As of 24 March 2026 | Jerusalem Post |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Handala | State-aligned | Claimed the Clalit Health Services breach and leaks of former officials' data in 2026. The FBI has linked the persona to Iranian intelligence. | Times of Israel · Insurance Journal (Bloomberg) | Profile |
| Cyber Isnaad Front | State-aligned | Profero attributes a 2026 sabotage of an Israeli food plant's refrigeration controls to this group and links it to the IRGC. | Ynet |
Laws and rules this year
Full stories
Official statements
- 2 Oct 2026Commenting on Microsoft's Digital Defense Report, Karadi said Israel keeps operational continuity under this scale of threats and that there is no ceasefire in cyber. Ynet
- 29 Jun 2026Karadi told Die Welt that hostile cyber incidents rose to about 4,800 in June 2026 and that attacks on critical infrastructure had been fended off. Al-Monitor (Reuters)
- 12 May 2026The INCD warned of a broad influence operation using threatening text messages and told recipients not to reply, click links or forward them. Ynet
- 24 Mar 2026INCD head Yossi Karadi said Iran had not infiltrated or disrupted energy grids, banks or hospitals, and noted Israel has not yet passed a cyber law. Jerusalem Post
Incidents
6 of 6 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ⚠️ ClaimedUnnamed Israeli food plant (refrigeration controls) | 7 Nov 2026 | Manufacturing | Intrusion | Claimed. Israeli security firm Profero says attackers changed cold room controls in May, destroyed three compressors and planted wiper malware, and attributes the attack to Cyber Isnaad Front, which it links to the IRGC. No official confirmation was reported. | Ynet✓ 7 Nov | |
| ✅ ConfirmedIsraeli public (mass text messages) | 12 May 2026 | Other | Not disclosed | Confirmed. The INCD said it identified a broad influence operation of threatening text messages sent to thousands of Israelis and told recipients not to reply or click links. | Ynet✓ 7 Nov | |
| ✅ ConfirmedMore than 50 small Israeli companies | 24 Mar 2026 | Other | Intrusion | Confirmed. INCD head Yossi Karadi said Iran-linked hackers destroyed the data of more than 50 small Israeli companies in the weeks after the war began, and most have restored operations. | Insurance Journal (Bloomberg) · Jerusalem Post✓ 7 Nov | |
| ✅ ConfirmedIsraeli public and residential security cameras | 24 Mar 2026 | Other | Intrusion | Confirmed. Karadi said about 50 public cameras were hacked in three weeks and the INCD helped block 50 attempts, mostly on poorly secured residential cameras. | Insurance Journal (Bloomberg) · Jerusalem Post✓ 7 Nov | |
 ✅ ConfirmedIsrael Railways | 11 Mar 2026 | Transport | Defacement | None | Confirmed. Karadi said hackers took over Israel Railways monitors at a couple of locations and broadcast false messages to cause panic. | Jerusalem Post✓ 7 Nov |
 ⚠️ ClaimedClalit Health Services | 25 Feb 2026 | Health | Data leak | Claimed. Handala said it breached Israel's largest healthcare network and released medical information on more than 10,000 patients. | Times of Israel✓ 7 Nov |
FAQ
Does Israel have a national cyber threat level?
No published national cyber threat level was found for Israel (checked 7 Nov 2026). The INCD publishes no public cyber threat level and signals threat through statements by its director general Yossi Karadi and warnings to the public.
Which organisations in Israel confirmed cyber incidents recently?
4 incidents confirmed since January 2026: Israeli public (mass text messages), More than 50 small Israeli companies, Israeli public and residential security cameras and Israel Railways.
Which Israel organisations appear on ransomware or leak sites?
2 claims, not confirmed by the organisations: Unnamed Israeli food plant (refrigeration controls) and Clalit Health Services.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.