Haaretz says Handala exposed a Yahalom commander; no second desk has matched it

Haaretz reported on 24 October, under the byline of Oded Yaron, that Handala — which the paper describes as a hacking group linked to Iranian intelligence — had exposed the identity of the commander of the IDF’s Yahalom combat engineering unit, publishing his schedule, photographs of him and his family, and further military material that Haaretz characterises as capable of putting senior officers at risk. Haaretz says the IDF told it the breach is under investigation. The leak itself is described in the copy as having occurred on Tuesday, 20 October, which makes the publication rather than the intrusion the news peg. Both the English and Hebrew versions are paywalled; there is no named on-the-record speaker in the retrievable text, and the IDF response is paraphrased, not quoted. No file count or volume figure is given.

As of Monday no independent corroboration had surfaced from Ynet, the Times of Israel, Calcalist, the Jerusalem Post or i24 on this specific leak. Aggregators are meanwhile bundling it with two other October Handala claims: a Tehran Times item of roughly 19 October asserting a breach of the Israeli military’s media intelligence hub with “thousands of files,” carried by an Iranian state-aligned outlet and unverified, and a claim around 16 October regarding a former Israeli foreign minister’s data. Separately, the April 2026 leak of 19,000 files relating to former chief of staff Herzi Halevi continues to surface at the top of Handala searches and was recycled in video content posted around 22 October. That figure is six months old.

Whether October’s claims represent one intrusion or several is unestablished, and the distinction matters: a single compromise re-released in instalments is a different capability from three separate penetrations. Handala’s output is structured to make the two indistinguishable.

Assessment: The weak point here is not Haaretz, it is the shape of the evidence. An attacker-published dossier plus an unattributed confirmation that someone is investigating it is the minimum viable proof of anything, and it is precisely what a group optimising for amplification would aim to produce. Volume of claims is being read as volume of access. Until a second Israeli outlet or the IDF Spokesperson speaks on the record, treat this as a claim that one serious paper judged credible enough to print — which is a real fact about the claim, not about the breach. Watch for the bundling: it is how six-month-old files become this week’s capability.