Hackers, apparently linked to Iran, said Friday they had broken into the servers of Israeli internet hosting company Cyberserve, bringing down a number of widely used websites.
The Black Shadow group, which Hebrew-language media reports said was Iranian, warned the Israeli company that it was in possession of data that could be leaked. The group has not confirmed that it is Tehran-backed.
“Hello Again! We have news for you,” the hackers wrote in a message circulated on social media on Friday evening. “You probably could not connect to many websites today. ‘Cyberserve’ company and their customers [were] hit by us. You may ask what about Data? As always, we have lots of it. If you don’t want your Data leaked by us, contact us soon.”
Black Shadow stole a vast trove of information from Israeli insurance company Shirbit last year and then sold it on the dark web when the firm refused to pay a ransom.
Cyberserve’s customers include the Dan and Kavim public transportation companies, the Children’s Museum in Holon, the Pegasus travel company and the blogsite of the Kan public broadcaster.
The websites of a number of Cyberserve’s customers were unavailable on Saturday morning.
Last year, the Black Shadow attacked the Shirbit insurance firm and opened ransom negotiations, but the company said it wouldn’t pay, leading to the dark web sale of information stolen from the firm.
Many of Shirbit’s clients are from the public sector and images of private documents released included the vehicle registration and credit card details of an employee at the President’s Residence, as well as personal correspondence and a marriage certificate, as well as the personal details of the president of the Tel Aviv District Court.
Unnamed Israeli officials told Channel 12 news at the time of the attack that they believed a state was behind the Black Shadow attack. However, they did not name the country.
Israel and Iran have been engaged in a years-long shadow war, with Israel