Israel Under Fire on the Dark Web: What We Found in September 2026

Over the past month, our dark web monitoring picked up a sustained surge in threat activity targeting Israel. Across multiple underground forums and Telegram channels, we observed threat actors advertising, selling, and leaking data tied to Israeli citizens, municipalities, universities, and the defense sector. In this post, we break down what we found, what appears credible, and what looks like hype.

A month-long pattern, not a one-off

It is important to understand that this was not a single incident. Between early and late September 2026, we tracked more than a dozen distinct listings referencing Israel. Together they suggest opportunistic targeting across every layer of Israeli society.

Tel Aviv–Yafo Municipality ransomware (BLACKNET-00)

One of the most concrete findings was a ransomware post from a group calling itself BLACKNET-00, which named the Tel Aviv–Yafo Municipality as a victim on September 25. Weeks earlier, on September 5, a separate actor advertised a 135 MB Social Welfare Office database allegedly taken from the Yehud-Monosson Municipality. Local government is a soft target, and the data it holds is highly sensitive.

Yehud-Monosson Municipality social-welfare DB
The volume of citizen data on offer was striking. Listings included 2 million and 1 million Israeli citizen records, a fresh batch of 37,000+ national IDs with full names, and a 19,000-record combo list dated September 24. On Telegram, one actor claimed to be leaking the information of over 350,000 Israelis who had registered with the government.

Israel 37k national IDs + full names

Education and defense

The education sector was also hit, with 102,000+ student records from campus.gov.il appearing on multiple forums, alongside an Israeli Students Union data leak. Several actors referenced the

Israel Ministry of Defense, including a listing for SIBAT staff and user data (SIBAT is the ministry's international defense-cooperation directorate).

campus.gov.il 102k student data

We also saw a claim of "200 million IDF records" — larger than Israel's entire population — but the data could have some duplicate fields, and an "FBI and Mossad Top Secret 33GB leak."

200 million Israel IDF records

FBI and Mossad 33 GB data leak

Why this matters

For organizations with exposure to Israel — operations, supply chains, or personnel — this surge is a clear signal to review credential hygiene, monitor for exposed data, and assume municipal and sector data is actively circulating. Continuous dark web monitoring turns these scattered signals into early warning.

Sinon continuously monitors dark web forums and Telegram channels for threats to our customers.