Cyber Incident Victim: Haaretz
Date:
Nov 2015
Location:
Israel
Summary
Pro-Palestinian hacktivists compromised a major Israeli newspaper's Twitter account, posting violent threats in Hebrew and Arabic that referenced martyrs drinking soldiers' blood and a "knife intifada," alongside graphic images of blood-covered historical figures and a wounded individual. The attackers exploited the symbolic timing of the Balfour Declaration anniversary during the breach. The publication regained control after collaborating with Twitter for approximately an hour, deleted the malicious content, and issued a public statement via Facebook acknowledging the incident while asserting resilience against intimidation attempts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 3, 2015, coinciding with the 100th anniversary of the Balfour Declaration, pro-Palestinian hacktivists compromised the official Twitter account of Israeli newspaper Haaretz. The attackers posted over a dozen threatening messages in Hebrew and Arabic targeting Israeli soldiers and settlers. One tweet stated: “Our martyrs’ mothers will drink your soldier’s blood,” while another referenced an impending “massacre” and the continuation of the “knife intifada.” A graphic image depicting a wounded Israeli individual accompanied these posts. Additional manipulated images featured historical figures including former Israeli leaders, British Foreign Secretary Arthur Balfour, and Balfour Declaration signatories, all altered to show bloodstains and devil horns. The attackers explicitly linked their actions to the Balfour Declaration centenary in multiple posts, with one message declaring: “The memory of the Balfour Declaration has changed the situation.” The hack persisted for approximately one hour before containment efforts began.
Haaretz confirmed the breach through an official statement and directly engaged Twitter support to regain account control. The newspaper systematically deleted all unauthorized tweets following account restoration. Concurrently, Haaretz issued a public warning via Facebook acknowledging the Twitter compromise while asserting the attack failed to intimidate the organization, vowing to respond “at the right time and the right place.” Resolution efforts involved collaboration with Israeli Twitter users, whom Haaretz publicly thanked for their rapid assistance in mitigating the crisis. The incident temporarily disrupted the newspaper’s official communications channel but did not affect other digital platforms according to available evidence. No further details regarding technical intrusion methods, data compromise, or extended operational impacts were disclosed in the source material.