Cyber Incident Victim: Ministry of Justice
Date:
Mar 2024
Location:
Israel
Summary
Anonymous hackers breached the Israeli Ministry of Justice's systems, compromising employee data and official documents while claiming access to millions of files and hundreds of gigabytes of information. The group also defaced Paraguay's National Institute of Statistics website with anti-Israel messages, citing retaliation for UN-related positions. The incident occurred amid heightened regional tensions and followed warnings of expected cyberattacks targeting Israeli infrastructure. While the ministry confirmed the breach and initiated investigations with national cybersecurity authorities, Anonymous asserted the attack aimed to pressure Israel amid ongoing conflict, additionally referencing recent breaches at several hospitals. Security agencies had previously alerted about coordinated hacktivist campaigns seeking to disrupt systems and leak sensitive data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 1, 2024, hackers breached systems belonging to Israel's Ministry of Justice, with the anti-Semitic hacktivist group Anonymous claiming responsibility for the attack. The Ministry confirmed the intrusion occurred that morning and initiated damage assessments, noting no immediate disruption to public services but acknowledging potential data exposure. Anonymous publicly asserted it had exfiltrated "millions of pages of information and hundreds of gigabytes of data" from both the Ministry of Justice and the National Insurance Institute during a 24-hour campaign. The group claimed access to 8 million bank files and approximately 300GB of documents, including personal details of individuals appearing on unspecified lists, framing the attack as a measure to end the Israel-Hamas war through infrastructure destruction. Concurrently, Anonymous targeted Paraguay's National Institute of Statistics website in retaliation for Paraguay's UN Security Council vote against Israel, defacing it with an image of Prime Minister Benjamin Netanyahu and the phrase "F#k Netanyahu." Additional breaches were reported at Ziv, Mayanei HaYeshua, and Rambam medical centers during the same timeframe.
The Ministry of Justice stated it had prepared for such scenarios in advance and immediately notified relevant authorities including the National Cyber Directorate and Privacy Protection Authority. Technical teams worked continuously to evaluate the incident's scope and implications, though the full extent of compromised materials remained under investigation at the time of reporting. The attack coincided with a National Cyber Directorate warning about expected cyber assaults starting that Friday, citing heightened anti-Israel sentiment following Ramadan and calls for global hacktivist actions against Israeli digital infrastructure. These included planned website defacements, smart home system attacks, and dissemination of falsified or classified documents. Geopolitical tensions escalated simultaneously, with Israeli security forces on high alert for potential Iranian retaliation following the Damascus consulate strike that killed Iranian commander Mohammad Reza Zahedi. Prime Minister Netanyahu addressed the security climate during a cabinet meeting, vowing to counter Iranian aggression through defensive and offensive measures while asserting Israel's capacity for self-defense.