Check Point counts a 107 percent rise in attacks on Israeli infrastructure as Israelis vote

Check Point Software Technologies published research on Sunday 25 October finding a sharp rise in attack volumes against Israeli targets in the weeks before today’s Knesset election. Calcalist’s CTech carried it the same afternoon, the Times of Israel liveblog and i24NEWS on 26 October. The headline figures, measured against the same period in 2025: an average of 2,700 attacks per week against Israeli organisations, up 55 percent; roughly 2,300 per week against the government sector, up 82 percent; and roughly 3,900 per week against energy and infrastructure, up 107 percent — the only sector in the dataset where the count more than doubled. Check Point also says it has verified around 87 attacks against Israel since the start of October, most of them attempts to take websites offline or deface them, and that more than 1,200 election-related domains were registered in September and October, of which about one in 47 is assessed as suspected-malicious.

The softer claims travel further than the counts. Check Point reports threat actors discussing plans to knock major Israeli websites offline on election day, phishing campaigns built around fake “verify your details” messages pointing at credential-collection pages, a specific call to attack the Yashar party website and increased posting volume by Handala referencing the elections — the last two carried by i24 alone. It also notes that a database claimed to hold records on 6.5 million Israeli voters is “once again” being offered on dark-web forums, wording that points to recycled or repackaged material from an earlier breach rather than a fresh compromise. None of the incident counts has been corroborated by the Israel National Cyber Directorate in anything published so far, and none of the three outlets attributes the findings to a named Check Point researcher.

Assessment: Three outlets carrying the same vendor press cycle is one data point, not three. The 107 percent figure is the one built for a tile, but Check Point’s own description of the verified incidents — defacement and denial of service — describes the cheapest category of attack there is, the kind that inflates counts without demonstrating access to anything. A security company publishing election-threat statistics 48 hours before a national vote is doing commerce as well as research. The test runs today and settles tomorrow: if the forecast election-day outages do not materialise, that absence is the finding. Watch for the National Cyber Directorate’s own period figures. Two independent counts that diverge would be worth more than either on its own.