Israel’s election cyber story rests on a vendor number, a Telegram claim and a flower delivery

Calcalist’s CTech published on roughly 26 October, i24NEWS and a Times of Israel liveblog entry on roughly 27 October, each reporting that cyberattacks on Israeli organisations have risen ahead of the election. The common source is a release from Check Point, an Israeli commercial security firm whose customers are the organisations in question. Three outlets are not three sources. The Files is not carrying the headline percentage, because the number is uninterpretable without the comparison period and the sector breakdown, and because it has not been established whether the attribution to Iran is Check Point’s or the reporting outlets'. No corroborating figure from a second vendor, and none from Israel’s National Cyber Directorate, has surfaced in the window. A vendor count of attack attempts is a measure of noise reaching a sensor, not of damage done.

Separately, The National in Abu Dhabi reported on 27 October that Handala — an Iran-nexus hack-and-leak and wiper group whose methods Check Point Research documented in March and which Deepwatch has flagged for escalating disruptive operations — delivered bouquets and letters to Israeli polling sites. As of this edition no Israeli outlet surfaced matching it, and no confirmation surfaced from Israeli police, the National Cyber Directorate or the Central Elections Committee. A flower sent to a polling station is a demonstration of reach, not an intrusion; the US Justice Department’s March action against Iranian cyber-enabled psychological operations describes exactly this business of making access look larger than it is. Until someone in Israel confirms a delivery occurred, this is a group’s claim about itself, reported as a claim.

The third strand is domestic. Al Jazeera reported on 25 October on bots, deepfakes and surveillance in the Israeli campaign; JNS on 28 October ran the counter-framing, on technology deployed to protect the vote. Claims circulating in downstream aggregation — that bot networks from the Iran war have been repurposed for domestic campaigning, that a dead soldier’s likeness appeared in generated video, that Itamar Ben-Gvir’s campaign distributed AI video — have not been traced here to their originating reporting and are not asserted. Tasnim, the IRGC-affiliated Iranian agency, published its own version on 25 October, framing the campaign as Israeli politicians waging digital war on each other: a party to the information conflict reporting the information conflict, and useful only as evidence of what Tehran wants amplified.

Assessment: The three strands point in different directions and should not be welded together. A vendor’s attack count, an adversary group’s self-promotion and a domestic synthetic-media fight are not one Iranian campaign. The cheapest operation available to an Iran-linked group during an Israeli election is a claim that costs nothing and gets carried; the expensive, consequential material is being made by Israeli campaigns about Israelis. The same mechanism drives today’s lead: a claim moving faster than its verification. Before polling day this desk sets its bar now — no reported election-infrastructure incident without confirmation from the Central Elections Committee, the National Cyber Directorate or police. Claimed disruption will outnumber real disruption.