IDF ignored a soldier’s warning for a week as conscript records sat online, TheMarker reports

Haaretz’s business title TheMarker reported on Sunday 23 August that the material was exposed in what it called another leak of IDF information from soldier-developed sites and applications built with artificial intelligence. According to the report, a soldier who alerted the army to the exposure received no response, and the information was taken offline only after TheMarker contacted the IDF. The report is single-sourced and paywalled; no IDF Spokesperson statement appears in the retrievable text, and it is not established whether the figure of roughly 170 is TheMarker’s own count or the army’s, nor whether the applications were sanctioned. The same week supplies the adversary-side counterpart: on 16 August the Shin Bet and the Israel National Cyber Directorate said in a joint statement that Iranian intelligence operatives were contacting Israeli journalists on WhatsApp and Telegram, posing as familiar figures and offering interviews or collaborations in order to compromise devices and accounts. Haaretz reporters were among the targets.

Assessment: The number is the least interesting part. The reportable failure is procedural: an internal warning produced nothing for a week, and remediation arrived only when a newspaper called. That is a disclosure pipeline that runs through the press rather than through the chain of command, which is precisely the condition under which a hostile service does not need to hack anything. Note the word “another” — TheMarker is tracking a pattern, which implies either a running count inside the army or the absence of one. Both are worse than a single incident. Set against the Shin Bet’s on-the-record phishing warning, the asymmetry is stark: the state can name the adversary campaign it faces far more readily than it can inventory what its own conscripts have published.