One Check Point report, three different attack counts, and no confirmed breach of an Israeli election system
Four days after the 27 October Knesset vote, the most-cited cyber figures come from a pre-election vendor report that three outlets read three different ways — and that none of them says election systems were compromised.
Check Point published its Israeli election research on 25 October, two days before the vote. Calcalist reported on 25 October that attacks on government entities rose 82% and those on energy and infrastructure 107%, with organisations in Israel facing an average of 2,700 cyberattacks per week in early October, a 55% increase on the same period in 2025. The Times of Israel, a day later, attributed the 2,700 figure to government bodies specifically, at an 82% increase, with energy and infrastructure attempts up 107% to 3,900 weekly. JNS, picking the report up around 28 October, reported approximately 2,300 attacks per government organisation per week, also an 82% increase. One report, three readings, now circulating as settled fact. The firmer numbers are smaller: Check Point confirmed around 87 cyberattacks against Israeli targets since early October, mainly denial-of-service and defacement, and counted more than 1,200 new election-related websites registered over two months, roughly one in 47 suspected malicious, including a campaign impersonating a “Voter Information Service” by SMS and email.
Check Point singled out Handala, which it said had sharply increased its publication frequency with explicit reference to the election; its own 27 October deck records a “13-night countdown to the elections,” a claimed breach of an unnamed Israeli payment-systems supplier relayed as Handala’s, and a TikTok account using the Central Elections Committee’s name, logo and Hebrew display name. Dark-web monitoring identified the Prime Minister’s Office, the Knesset, the Israel Police, the Foreign Ministry and the Bank of Israel as planned election-day denial-of-service targets. A database purportedly holding 6.5 million Israeli voters' details was “once again” offered for sale. Sivan Dror, Check Point’s director of research and exposure management, said the days around an election are “a critical period during which malicious actors attempt to exploit heightened public attention to amplify their impact,” and urged the public to rely “exclusively on official election channels.” JNS supplied the caveat the figures require: they “concern cyber activity against Israeli targets generally, not confirmed compromises of election systems.”
Assessment: The discrepancy is the finding. A single vendor deck mutated across three news cycles into three incompatible claims about who was attacked and how often, and the version that travels furthest is usually the largest. Against that, the verified count — 87 incidents, mostly denial-of-service and defacement — describes nuisance and spectacle, not interference. Handala’s countdown is a publication schedule, not an intrusion campaign; its payment-supplier breach remains a claim with the victim unnamed. Two party-level allegations logged on the eve of the vote remain headline-only and unreported-out. Post-vote summaries now circulating on anonymous aggregator newsletters, including claims about a military unit doxxing and a foreign-funding referral, are unsourced to any first party. None of it belongs in an interference narrative yet.