Cyber Incident Victim: Technion – Israel Institute of Technology
Date:
Apr 2015
Location:
Israel
Summary
A cyberattack campaign associated with OpIsrael targeted numerous Israeli entities, including the Technion institutions, compromising approximately 700 websites and leaking extensive personal and financial data. Perpetrators such as Anonymous Arab, AnonGhost, and Anonymous Arabe exfiltrated thousands of credentials, including PayPal accounts, email passwords, and modem logins, alongside personal details of 150,000 individuals sourced from Israeli portals. The breach involved structured data leaks published on platforms like Pastebin, impacting government, business, and academic websites, with additional attacks planned over subsequent weeks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
The Technion Center for Structural Biology was compromised during the 2015 OpIsrael campaign, a coordinated cyber offensive against Israeli digital infrastructure by multiple hacking collectives. Between late March and early April 2015, groups including Anonymous, Anonymous Arab, AnonGhost, and Anonymous Arabe executed widespread attacks on Israeli government and business websites. The Technion institutions were explicitly named among the defaced targets alongside the Jerusalem Center for Public Affairs and Honda Israel. Attackers breached approximately 700 websites total, with defacement evidence publicly listed on Pastebin and Ghostbin repositories. The campaign's operational timeline extended through April 20, 2015, indicating sustained targeting over several weeks. Initial breaches involved website defacements, though attackers rapidly escalated to credential harvesting and sensitive data exfiltration.
Hackers exfiltrated and leaked multiple datasets containing Israeli citizens' personal and financial information. Anonymous Arab released 2,143 PayPal account credentials while AnonGhost disseminated over 7,000 email-password combinations. Anonymous Arabe published the largest dataset—personal records of 150,000 individuals including full names, physical addresses, email accounts, and phone numbers. Analysis confirmed the data's authenticity, with compromised records originating from Israeli portals including area.co.il and walla.co.il. The Technion breach formed part of this broader credential harvesting operation, though specific details regarding compromised systems within Technion weren't disclosed. Additional leaks included modem login credentials for 6,000 Israeli internet modems. Attackers utilized Pastebin to host leaked PayPal credentials (dLGZA3rF), email lists (Cc0bV0w2), and citizen data (SqjFw9PW), enabling widespread access to stolen information. No remediation efforts or organizational responses were documented in available reporting.