Handala publishes the identity and family photographs of an IDF engineering commander

Haaretz reported on Saturday 24 October that Handala, which the paper describes as a hacking group linked to Iranian intelligence, had exposed the identity of the commander of the IDF’s Yahalom combat engineering unit, publishing his schedule, photographs of him and of his family, and further military material the paper characterises as endangering senior officers. Haaretz dates the exposure itself to “Tuesday” — 20 October, four days before publication. The IDF told the paper the breach is under investigation. That confirms the military is treating the incident as real; it does not confirm that any specific document Handala posted is authentic. The article sits behind a subscriber wall, and the commander’s rank, the route by which the material was obtained, and whether the IDF disputes any element of it are not established in the text available.

The Iranian-intelligence link is Haaretz’s characterisation. No Israeli government attribution has been published alongside it. A separate and older strand circulated inside the window: RealClearDefense aggregated on 26 October a 17 October commentary by Michael Groen placing Handala inside the Islamic Revolutionary Guard Corps' Cyber Economic Command and Iran’s Ministry of Intelligence, and recounting the group’s claims to have taken personal information on US servicemembers in the Middle East, including F-35-related material, and to have compromised the FBI Director’s email. Those are claims recounted in a signed opinion piece by a former officer, not vendor findings. The distinction matters: nothing in this week’s reporting establishes whether the Yahalom material came off a unit system or out of a third-party contractor breach.

Assessment: That last distinction is the whole story. A penetration of a military network and the resale of a contractor’s HR database produce identical-looking leaks and imply entirely different capabilities, and the group’s interest is in having you assume the former. Handala’s business model is publicity; the volume of its posting around the Israeli election, noted separately by Check Point, is consistent with a group timing disclosures for maximum political return rather than one working through operational access. Treat the IRGC and MOIS placement as an assertion in an opinion column until a government or a vendor says it. Watch whether the IDF says anything beyond confirming an investigation.