Iran was behind a cyberattack at an Israeli hospital on Yom Kippur that led to a leak of patient data, Israel’s National Cyber Directorate said Wednesday.
At the time, Israeli authorities said the attack at Shamir Medical Center in the central city of Be’er Yaakov had been “blocked in its initial stages,” and blamed a Russian-speaking cybercrime organization. The organization, called Qilin, appeared to have demanded a $700,000 ransom in exchange for withholding the leaked data.
But on Wednesday, the directorate said the attack was a prominent example of a wave of Iran-backed cyberattacks on Israeli businesses and government institutions. In these attacks, the agency said, hackers gain access to usernames and passwords and use them to infiltrate systems.
There have been at least 10 such cyberattacks, the directorate said, adding that they were stopped “quickly and efficiently.” The attacks appear to be part of a long-running Iranian effort to penetrate Israeli institutions and government agencies through espionage, recruitment of agents and other methods of subterfuge.
“Over the course of recent weeks, the National Cyber Directorate has identified a trend of a wave of cyberattacks against companies that offer computer services to many companies in the economy,” the statement said.
The statement continued: “Among the bodies that were attacked in the wave of Iranian attacks were Shamir Medical Center (Assaf Harofeh), where the attackers tried to interfere with hospital operations, without success.”
Israeli officials acknowledged that patient data was leaked during the attack. But Yosi Karadi, the head of the directorate, praised the government’s work blocking the hackers.
“Thanks to the cooperation, quick information sharing and targeted reaction, the events were shut down quickly and efficiently, avoiding wider damage to the economy, ” he said in the statement. “In the case of Shamir Medical Center, beyond the data leak, the very attempt to damage an Israeli hospital means a red line has been crossed, which could have led to an attack on human life.”
Earlier this year, cyber officials warned that Iranian and Hezbollah attacks against Israel have tripled since the Hamas onslaught of October 7, 2023, which sparked the grueling war in Gaza.
In May, Aviram Atzaba, the Cyber Directorate’s head of international cooperation, said that around 800 significant attacks had been thwarted since the war erupted. Among the targets were government organizations, the military and civil infrastructure.
Some attacks could not be foiled, including past incidents against hospitals in the cities of Haifa and Safed in which patient data was stolen.
In January, Iranian hackers managed to infiltrate panic buttons in some 20 Israeli kindergartens, using the systems’ loudspeakers to broadcast rocket sirens and Arabic songs supportive of terrorism.
