Iranian cyberattack triggers terror alerts at Israeli kindergartens

A cyberattack, believed to be orchestrated by the Iranian hacker group Handala, has targeted Israeli kindergartens, including hijacking speakers to broadcast terror alerts.

The group reportedly exploited a vulnerability in the Maagar-Tec system, which provides emergency alert services, to trigger rocket sirens and play terror-supporting songs, affecting sites across the country.

The breach is understood to have impacted around 20 educational facilities nationwide.

“Earlier this morning, the National Cyber Directorate (NCD) received reports of a breach involving emergency buttons installed in several kindergartens. Investigations revealed that a cyber group had accessed the private supplier's system, using it to broadcast terror-supporting songs and alarm sounds,” a spokesperson for the agency confirmed on Sunday.

In addition to disrupting educational institutions, the hackers are believed to have sent tens of thousands of alarmist text messages to Israeli citizens as part of the same coordinated attack.

Authorities quickly advised citizens who received the messages, which threatened to make civilians “pay for the crimes and foolishness of your leaders” and urged people to evcuate cities, to block them and assured the public that there was no immediate security risk.

Meanwhile, Handala claimed responsibility for breaching Israel’s national security ministry systems, stating they had stolen numerous files containing sensitive information about Israeli police officers.

“The incident is currently under containment,” the NCD said in a statement, adding that it was working closely with Maagar-Tec and the Ministry of Education to ensure the systems are restored and secured.

Maagar-Tec, the Israeli company responsible for the emergency systems, issued a statement on their website confirming that it was conducting ongoing maintenance and have temporarily taken it offline.

The NCD also recommended that municipal system administrators using Maagar-Tec’s emergency buttons update their passwords with more secure options.

Authorities instructed affected institutions to disconnect their systems from power until the situation was resolved.

In the lead-up to the attack, Handala posted a video on X showing two dragons launching fire toward each other, followed by the message "HANDALA ON THE WAY."

This was followed by the group's emblem alongside a message reading “WHO WILL WIN?” — a reference to the ongoing conflict between the hacker group and the State of Israel.

Handala, which takes its name from a symbol of Palestinian resistance created by cartoonist Naji al-Ali in 1969, was also the mascot of the 2009 Iranian Green Movement, which demanded the removal of then-president Mahmoud Ahmadinejad from office.