Iran's cyberattacks on Israel tripled in 2026 as kinetic war extended to digital infrastructure
Israel's National Cyber Directorate chief Yossi Karadi told Die Welt on June 29 that hostile cyber incidents rose from 1,600 in June 2025 to 4,800 in June 2026, targeting critical infrastructure, mid-sized firms, and the public; there is 'no ceasefire in cyberspace'
Add to a list
No lists yet.
Summary
Yossi Karadi, Director General of Israel's National Cyber Directorate, said on June 29 that hostile cyber incidents attributed to Iran tripled from approximately 1,600 in June 2025 to 4,800 in June 2026. Karadi made the disclosure to German daily Die Welt, saying the attacks targeted Israel's critical infrastructure, large organizations, small and medium-sized firms including law practices and accounting firms, and the general public. "We can handle them, but we have to take them seriously. Unlike in the kinetic realm, there's no ceasefire in cyberspace," Karadi said. The disclosure came on the same day as Iranian ballistic missile and drone strikes on US military facilities in Bahrain and Kuwait.
Why it matters
The ceasefire MOU signed June 17 governs kinetic hostilities and diplomatic processes; it contains no cyber provisions. Iran's ability to triple digital attack volume while technically inside a ceasefire shows the MOU's structural gap: the framework halts bombs but not code. For Israel's civilian economy, the SME targeting signals Iran is attempting to erode economic confidence through non-attributable disruption rather than only headline military strikes.
What to watch
- Whether Israel or the US attempt to add a cyber-operations clause to the ceasefire implementation discussions in Doha.
- Specific sectors: if attacks shift from SME disruption to critical infrastructure outages (power, water, banking), the threshold for a kinetic response under the MOU becomes contested.
- Whether other ceasefire parties, particularly Lebanon and the Gulf states, see similar cyber-incident spikes in parallel.