The Iran-linked hacking group Handala said it stole 150 gigabytes of confidential Israeli material after breaking into a transcription and archiving platform used by courts and police, according to reports carried by Iran’s Fars news agency on Saturday and repeated by international outlets on Sunday. Handala framed the alleged theft as a blow to Prime Minister Benjamin Netanyahu’s security messaging days before Israelis vote on Oct. 27, but neither Malam Technology nor Israeli government agencies had issued on-the-record confirmations or denials by late Sunday.
What the E-Type platform does
Handala identified its target as the “E-Type” system developed by Malam Technology, part of the Malam Team group that markets speech-to-text and secure archiving services to Israeli public-sector clients. According to the group’s statement as relayed by Fars and Anadolu Agency, E-Type is built to transcribe and store audio from confidential judicial hearings and law-enforcement investigations, creating searchable records tied to thousands of security and criminal cases.
Israeli cybersecurity monitors began circulating screenshots and download links Handala posted alongside its claim. The site Cybersecurity Israel noted on Saturday that Handala advertised roughly 150 gigabytes for direct download as proof of access, alongside images that purported to show internal interfaces. Those materials are unverified third-party postings; InfoHandle has not independently authenticated the files.
Supply-chain intrusion alleged
Handala described the operation as a “multilayered supply chain attack,” language that implies compromise through a vendor or integration partner rather than a direct assault on a government data center. The group said the intrusion gave it access to the full corpus of stored audio and transcripts on the platform. Supply-chain angles matter because transcription vendors often sit between investigators, courts, and cloud or on-premise storage—expanding the number of firms that must be audited after a breach claim.
Western and regional outlets including Yeni Safak and Anadolu stressed that Handala tied the timing of its release to Israel’s election calendar and Netanyahu’s campaign pledges on security. Handala has previously claimed intrusions against Israeli infrastructure during periods of heightened conflict with Iran; analysts treat its disclosures as part of an influence campaign even when technical indicators later prove partial or exaggerated.
What remains unconfirmed
As of Sunday evening in Tel Aviv, public statements from Malam Technology and Israeli police or justice ministries were not available in wire coverage reviewed by InfoHandle. That gap leaves several questions open: whether any exfiltration occurred, whether published samples match live government systems, and whether courts must notify parties whose sealed hearings might have been exposed.
Incident responders typically look for three signals after a leak-site announcement: cryptographic or metadata matches to authentic recordings, victim notification under Israeli privacy law, and downstream impact on active prosecutions. Until one of those appears, the episode sits in the uncomfortable space between a serious espionage claim and unverified hacktivist marketing.
Why the calendar matters
Israel’s general election is scheduled for Monday, Oct. 27, with security and the Iran conflict already central campaign themes. A data breach affecting judicial and police archives—if substantiated—could force emergency rotations of credentials, delay sensitive trials, and become fodder for domestic political attacks regardless of foreign attribution.
For defenders elsewhere, the claim is a reminder that outsourced transcription and evidence-management tools hold the same sensitivity as the agencies that feed them. Handala’s 150-gigabyte figure may shrink or grow as researchers parse the dump; the operational lesson is earlier: map which vendors can read the microphone in the interrogation room.