Iran-linked cyberattacks on Israel surge to 4,800 incidents, official says

Israel’s National Cyber Directorate said hostile cyber activity reached about 4,800 incidents in June 2026, a sharp increase from roughly 1,600 in June 2025, as the conflict with Iran spread deeper into the digital realm. Yossi Karadi, the director general of the directorate, said the rise came alongside broader fighting and showed that cyber operations were no longer a side channel to the war.

The June figure built on an already elevated threat picture. In January 2026, Karadi said the directorate handled more than 26,000 cyber incidents in 2025, a 55% increase from 2024. He said the most targeted sectors were the financial system, government institutions and digital service providers, three categories that sit close to the nerve centers of civilian life and state administration.

The directorate also said in February 2026 that it issued about 2,480 alerts in 2025, including 2,304 proactive notifications sent to organizations after indicators of targeted attacks. That warning volume suggests Israeli defenders were already spending much of the year chasing intrusions before the June surge added another layer of pressure.

Karadi has described Iran’s cyber warfare apparatus as a multi-layered system with the Iranian military and the Islamic Revolutionary Guard Corps at its core. He has also said some of the actors involved are civilians and activists who hack out of conviction or are paid to do so. In the same account, he tied the campaign to digital propaganda, including Lego-style AI animation videos, showing that the operation extends beyond network intrusions into influence work designed to confuse, intimidate or shape public perception.

Karadi also said cyberattacks against Israel doubled on the day the ceasefire ending the 12-day war was signed in June 2025, underscoring that the digital front has kept moving even when firing slowed. His warning that there is effectively no ceasefire in cyberspace fits the pattern now facing Israel, where public agencies, private companies and essential service providers are being pressed by a campaign that mixes hacking, propaganda and persistent probing.