Hackers Allegedly Linked to Iran Threaten to Leak Client Data From Israeli Websites - Reports

Among those breached are reportedly LGBTQ+ dating app "Atraf", Dan bus company and tour booking company Pegasus.

A hacker group allegedly linked to Iran has infiltrated the servers of Israeli internet hosting company Cyberserve, removing a number of widely used websites and threatening to leak data, Israeli media reported Saturday.

The hacker group, Black Shadow, reportedly messaged the Telegram account of Cyberserve Friday, alerting the company to their attack after taking their client’s sites offline — these included public transport companies, a children’s museum and other major sites, according to The Times of Israel.

It is still not confirmed if the group is Tehran-backed.

"Hello Again! We have news for you," the hackers wrote in a message that circulated on social media Friday. "You probably cannot connect to many sites tonight, and that is because the Cyberserve company and its customers were targeted by us. And what about information? As usual, we have a lot of it. And if you do not want your information revealed, contact us soon."

The attackers behind Shirbit and KLS continue to attack Israeli organizations

Now - "Cyberserve" pic.twitter.com/3YIljqpVlP

— Blackeye intelligence (@BLACKEYEintel) October 30, 2021

The hackers on Saturday night also released some alleged personal information, consisting of names of “Atraf” users and their locations from an online LGBTQ+ dating site, according to Hebrew media reports. The data leak had worried users that it could expose those not wanting to disclose their sexual orientation.

Microsoft confirmed this month that Iran had increased its hacks on Israel from last year.

“Microsoft detected an increased focus from a growing number of Iranian groups targeting Israeli entities… and with that focus came a string of ransomware attacks,” the company’s annual Digital Defense Report said.

Last year, Black Shadow hit Israeli company Shirbit, stealing a massive amount of information that they later sold on the dark web after their refusal to pay a ransom.

Because Shirbit’s clients belong to the public sector, sensitive and private documents were leaked in the previous hack. Images of private documents including the vehicle registration and credit card details of an employee at the president’s residence, as well as the personal details of the president of the Tel Aviv District Court.