Loading story…
An Iran-linked hacker group claimed it had breached servers belonging to Clalit, one of Israel’s largest healthcare organizations, according to The Jerusalem Post. The report said the attackers asserted they had accessed Clalit systems, raising concerns about potential exposure of sensitive medical and personal information tied to a major national healthcare provider.
The claim fits a broader pattern in which politically motivated or state-aligned actors target high-value institutions and then publicize intrusions to amplify pressure and uncertainty. While the available reporting did not independently confirm the full scope of the compromise, the incident drew attention because healthcare networks hold large volumes of regulated patient data and are considered critical infrastructure with significant operational and privacy risks if breached.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
The Jerusalem Post reported that an Iran-linked hacker group claimed it had hacked servers belonging to Clalit. The event reflects a claimed intrusion and attribution to an Iran-linked actor.
Spectre chip attacks were reported to be exploitable through major web browsers including Safari, Chrome, Firefox, and Internet Explorer. The disclosure expanded understanding of the vulnerability's practical attack surface.
South Korean cryptocurrency exchange Bithumb was reported hacked, affecting accounts and drawing attention to security risks at major crypto trading platforms. The Fortune reference ties the incident to Bitcoin and Ethereum trading activity.
The source code for the Mirai Internet of Things botnet was released publicly, making the malware broadly available. This disclosure marked a significant escalation in the DDoS threat landscape.
Leaked Democratic National Committee emails became a major political issue, prompting Bernie Sanders to call for the DNC chair's resignation. The leak was publicly impacting the convention by late July 2016.
A Fortune report described a product demonstration that revealed what it called the biggest-ever government data breach, referring to the U.S. Office of Personnel Management incident. The reference indicates public attention on the scale and exposure of the breach by mid-2015.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
jpost.com
Open sourcefortune.com
Open sourcefortune.com
Open sourcefortune.com
Open sourcehaaretz.com
Open sourcefortune.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies warned that Iran could target **critical infrastructure** operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the **CyberAv3ngers** intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the **IRGC** and **MOIS**, to affiliated groups such as `APT33`, `APT35`, `APT34`/`OilRig`, and `MuddyWater`. The threat picture expanded as pro-Russia actors joined Iran-linked operations under **#OpIsrael**, with attacks reportedly including **DDoS**, claimed breaches, leaked CCTV footage, **SQL injection**, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Jun 29, 2026
Security experts warned that the escalating **U.S./Israel conflict with Iran** could spill into increased cyber activity by Iranian sympathizers, proxies, and hacktivist groups, with **healthcare** highlighted as a particularly exposed target due to its operational sensitivity and historically weaker security posture. Expected activity includes **DDoS**, **ransomware**, **wiper/destructive malware**, and **data theft**, with the risk extending beyond Iran’s own connectivity because many hacktivist operations rely on globally distributed infrastructure. A separate critical-infrastructure-focused advisory tied the heightened risk to the outbreak of open conflict and referenced *Operation Lion’s Roar* strikes on Iranian military and nuclear sites, warning that **Iranian state-affiliated APTs** may increase **espionage and disruptive attacks** against foreign networks and **industrial control systems (ICS/OT)** as part of a broader hybrid campaign. The guidance emphasized that defenders should plan for both opportunistic and state-directed activity affecting civilian infrastructure (e.g., energy and transportation) and prioritize resilience measures appropriate for critical infrastructure environments.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026