Cyber Incident Victim: Bank Leumi
Date:
Jun 2021
Location:
Israel
Summary
A cyber attack targeted Israeli bank websites over a weekend, involving hundreds of Malaysian hackers from the anti-Israeli group DragonForce. The attackers launched a distributed denial-of-service (DDoS) campaign aimed at disrupting services and taking down the sites by overwhelming them with traffic, peaking at approximately 200 Mbps. The group also leaked a file purportedly containing names and addresses of Israeli students. While the attack caused temporary slowdowns and service interruptions to external banking websites, operational systems remained unaffected due to their separation from the targeted public-facing infrastructure. The impacted organization stated such DDoS attempts are routine and typically mitigated without compromising core banking functions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In late June 2021, a coordinated cyberattack targeted Israeli banking websites over a weekend, involving hundreds of Malaysian hackers operating under the anti-Israel group DragonForce. The attackers launched a multi-wave distributed denial-of-service (DDoS) campaign aimed at disrupting banking services and attempting to take down websites by overwhelming systems with fraudulent traffic. The assault peaked during its final wave late Friday night, reaching approximately 200 megabits per second—a significant volume that caused measurable slowdowns and service interruptions across multiple bank platforms. On Saturday morning, Bank Israel's systems came under renewed attack, with at least one report indicating operational impact. The hackers publicly claimed success by releasing screenshots purportedly showing crashed bank computers, though some evidence appeared exaggerated or falsified upon closer examination.
DragonForce's primary objective was service disruption rather than data theft, leveraging participant numbers to overwhelm infrastructure. The group simultaneously published a file allegedly containing names and addresses of hundreds of thousands of Israeli students, expanding their anti-Israel activities beyond the banking sector. Banking cybersecurity experts mobilized defensive measures during the attacks, noting advance warnings from the perpetrators had allowed some preparatory actions. Bank Israel confirmed its external websites—hosted on separate government servers through the "Gov.il" platform—experienced typical DDoS attempts like other government entities, but emphasized these systems remained isolated from core banking infrastructure. This architectural separation prevented operational impacts despite visible website disruptions, with the bank characterizing such attacks as routine occurrences in public-facing systems.