Cybersecurity · Monday, 12 October 2026
A close aide to Israel's prime minister is hacked, and messages said to be his leak online 16 days before Israel votes
WhatsApp messages said to be from Jonatan Urich, an adviser to Benjamin Netanyahu, leaked on Sunday, after Haaretz reported a hole in a tool he built with AI. His lawyers confirmed the hack. Also today, malware at a contractor exposed 8.7 million records of a Japanese karaoke chain, and three more big US law firms reported break-ins.
27 Oct
the day Israel votes, 16 days after the leak
Semafor says hacked and leaked documents have hit Netanyahu's campaign again and again
2
people close to Netanyahu whose private files leaked on Sunday
aide Jonatan Urich, and ambassador Yossi Shelley, whose photos and videos also appeared
The lead story — what happened
-
WhatsApp messages said to belong to Jonatan Urich, a close adviser to Israel's prime minister Benjamin Netanyahu, were leaked online on Sunday.
[2] -
Photos and videos said to come from the account of Yossi Shelley, Israel's ambassador to the United Arab Emirates, leaked the same day.
[2] -
Urich's lawyers said in a statement on X that he had been hacked.
[1] They threatened legal action against anyone who publishes what was taken.[1] -
Haaretz, an Israeli newspaper, said it had verified the leak.
[1] -
The leak came after Haaretz reported a security hole in a news-tracking tool that Urich built for Netanyahu with Claude, an AI made by Anthropic.
[2] -
Semafor, a US news site, says Urich appears to have exposed sensitive information through that app, which was written with an AI's help.
[1] Neither report shows exactly how the attackers got in. -
The messages include talks between Urich and Amit Segal, the chief political analyst at Channel 12 News, Israel's leading TV news channel.
[1] In them Segal gives advice on the campaign's videos and messages, Semafor reports.[1] -
Segal said on Channel 12's news that the messages were part of a 'very delicate tango' between a journalist and the people he covers.
[1] -
Israel's privacy law bans republishing material that was obtained illegally.
[1] -
Semafor says Netanyahu's re-election campaign has been hit again and again by hacked and leaked documents before the vote on 27 October.
[1]
Who is involved
-
Jonatan Urich
a close adviser to Israel's prime minister, Benjamin Netanyahu; his WhatsApp messages leaked and his lawyers confirmed the hack
-
Amit Segal
chief political analyst at Channel 12 News, Israel's leading TV news channel; the messages show him advising the campaign
-
Yossi Shelley
Israel's ambassador to the United Arab Emirates and a former head of the prime minister's office; photos said to be his also leaked
-
Haaretz
an Israeli newspaper; it reported the hole in Urich's tool and says it verified the leak
How it unfolded
-
Before Sunday Haaretz reports a security hole in a news-tracking tool Urich built with Claude
[2] -
Sun 11 Oct Urich's messages and Shelley's photos and videos leak online
[2] -
By 11 Oct Urich's lawyers confirm the hack and threaten legal action; Haaretz says it verified the leak
[1] -
27 Oct Israel votes
[1]
Where this points
Watch whether more accounts from Netanyahu's circle leak before Israel votes on 27 October, and whether anyone shows how the attackers got into Urich's WhatsApp.
What is pushing on the whole day
The bar and the word are our reading of how hard each one is pushing today. The arrow is where it is heading. The evidence is in the stories below.
A gang copied documents from one user's laptop at Nelson Mullins, a US law firm.
Dread, a hidden forum, had to move to a new address, because a patch cannot take back a key that has already leaked.
Daiichi Kosho's customer records sat with Nippon Columbia, a music company it uses to handle them.
The rest of the day
6 more stories on this beat.
Each with its own sources. None of these is a link to the story above.
-
02
Karaoke chain's 8.7 million records exposed
Daiichi Kosho, Japan's biggest karaoke company, says malware at a contractor exposed records on 8,631,000 customers and 93,000 employees.
[3] Malware is harmful software, and it was found on one employee's computer at Nippon Columbia, a music and entertainment group that handles Daiichi Kosho's customer data.[3] Nippon Columbia told Daiichi Kosho on 5 October and cut the computer off the next day.[3] The records hold names, genders, birth dates, email addresses and phone numbers, but no passwords.[3] Daiichi Kosho says it has not confirmed that any data was stolen.[3] - Customers8,631,000 records · 99%
- Employees93,000 records · 1%
Almost every exposed record belongs to a customer, not a worker. Why it matters — Customers of Big Echo and five other chains it runs may be affected.
[3] Daiichi Kosho is advising them to stay cautious, and BleepingComputer, a security news site, advises distrusting unexpected emails, texts or calls that ask for payment.[3] -
03
Three more big US law firms hit
Holland & Knight and Squire Patton Boggs, two large US law firms, told the attorney general of Vermont, a US state, on Thursday that Social Security numbers were exposed in break-ins.
[4] A Social Security number is the ID number Americans use for tax and work. Holland & Knight says an attacker used tricks on people, called social engineering, to reach a firm computer from outside.[4] A day earlier another firm, Nelson Mullins, was sued; it says a gang that targets law firms copied documents from one user's laptop.[4] All three say the damage was limited.[4] Why it matters — Law firms hold their clients' private papers, money records and personal details, which is why gangs go after them, Reuters reports.
[4] Two other firms, WilmerHale and Weil Gotshal, have paid gangs after earlier break-ins, either a ransom or to keep stolen files quiet.[4] -
04
A software flaw hands over hidden websites' addresses
A flaw in GoBalance, a tool many hidden websites use to stay online under attack, lets anyone work out the secret key behind a site's address from public information.
[5] These sites run on Tor, a network that hides where a website is, and the key controls the address.[5] Searchlight Cyber, a security firm, disclosed it on 8 October.[5] Between 5 and 7 October both addresses of Dread, one of the biggest hidden forums, were taken over and pointed at a rival.[5] Its operators first blamed a slip, then the flaw.[5] No official fix exists yet.[5] Why it matters — A patch cannot take back a key that has already leaked, so an affected site has to move to a new address, as Dread and a market called Omega have done.
[5] Visitors to a hijacked address can be sent to a copy of the site, and Dread has told its users to change their passwords.[5] -
05
Swiss government pension fund leaks data
Publica, the fund that runs pensions for Swiss federal employees, said on Thursday that its data had leaked.
[6] The leak followed a cyber attack at the end of September on an outside company that supplies Publica's software.[6] Publica has not named the company.[6] The Swiss attorney general's office has opened an investigation.[6] Publica and the authorities are still working out how much data was affected.[6] Why it matters — The people at risk are Swiss government workers and others whose pensions Publica manages.
[6] Publica says no other federal body did business with the supplier.[6] -
06
Italy's foreign ministry fends off an attack
Italy's foreign ministry said on Thursday that its website had come under cyber attack.
[7] It said its security systems stopped the threat, and its services kept running.[7] Italy's ministry named no suspects.[7] It is checking whether the websites of Italy's embassies and consulates abroad faced similar attacks.[7] Why it matters — Italy's ministry did not say what kind of attack it was.
[7] That leaves open whether anyone tried to take data, or only to knock the website over. -
07
Police visit a man whose camera tracks police cars
Anthony Sistilli, a Canadian software engineer, built a number-plate camera that records only police cars, Tom's Hardware, a technology news site, reports.
[8] He made it as a protest against cameras like those of Flock Safety, a US company whose plate cameras police use to track ordinary drivers.[8] Two officers from Peel Regional Police visited his home in Brampton, Ontario, on 20 September to ask what he meant to do.[8] He posted a video about the visit on 7 October.[8] Why it matters — In the video, Sistilli says one officer worried that people could learn where officers live and when their shifts start.
[8] Sistilli says ordinary drivers have that worry about cameras that watch every car.[8] Several US cities, including Los Angeles, have suspended or cancelled their Flock contracts.[8]
When a fake looks perfect, only the owner can tell you
A fake website, address or message can look exactly right, so only the real owner can settle it, in a form nobody else can copy.
The twist
A fake that looks perfect is not caught by looking harder. It is caught when the real owner speaks up, in a way nobody else can fake.
How it works
- A copy can look exactly like the original
- An outsider cannot check it against the original
- Only the owner knows which one is real
- So the owner must say so, in a way a faker cannot copy
- Until the owner speaks, people act on the copy
The same force, elsewhere today
Where this chain is also running, in today's other stories.
-
The karaoke records at Nippon Columbia
Only Nippon Columbia, whose computer held the malware, can say whether records left it, and outsiders are left waiting because it has made no public statement.
-
The hijacked hidden-forum addresses
Dread's old address showed a rival's site, so its owners posted a message signed with their own key to say which new address was really theirs.
Where you've seen this
Phone calls from a bank
banks ask customers to hang up and ring the number on their own card, because a voice on the line proves nothing
Old paintings
experts trust a painting's record of past owners more than its look to rule out a forgery
Phone updates
a phone installs an update only if it carries the maker's digital signature, which a copycat cannot make
The catch
This only works when people can reach the real owner. An owner who wants to hide something can also deny a leak that is true.
And the whole of it
Most of what reaches us online is a copy of something. Each of us can check very little of it alone, so we lean on owners, venues and newspapers to tell us which copy is genuine.
What is really going on
Private messages and photos from people close to Benjamin Netanyahu, Israel's prime minister, are being leaked in the weeks before Israel's 27 October election, and none of today's reports says who is doing it.
Why it works on us — Private messages feel more honest than public statements because they were never meant to be seen, so a leak is easy to believe before anyone has checked it.
Who gains
-
Campaigns and groups working against Netanyahu
— Each leak puts his team's private planning in front of voters before the vote, part of wider efforts to unsettle him, Semafor says.
[1] -
Conclave, a rival hidden forum
— Dread's hijacked addresses sent Dread's visitors to Conclave's site between 5 and 7 October.
[5] -
Lawyers who bring group lawsuits over break-ins
— A firm that admits a break-in can be sued for failing to protect people's data, as Nelson Mullins was the day before two other firms reported theirs.
[4] -
Scammers, if the karaoke records were copied
— Real names, birth dates and phone numbers would make a fake call sound genuine; Daiichi Kosho is advising its customers to stay cautious.
[3]
Who pays
-
Amit Segal, Channel 12's chief political analyst
— The messages dent his image as an independent analyst, Semafor says, and he has had to defend them on air.
[1] -
8.6 million karaoke customers in Japan
— Their names, birth dates, emails and phone numbers sat on a contractor's system where malware was found.
[3] -
People whose details sat in two US law firms' files
— Holland & Knight and Squire Patton Boggs told Vermont's attorney general that Social Security numbers were exposed.
[4] -
Swiss federal employees whose pensions Publica runs
— Their pension fund's data leaked after an attack on its software supplier, and Publica cannot yet say how much.
[6]
What nobody knows yet
Open questions from across today’s stories — ours included.
-
01
Who took Urich's messages and Shelley's photos.
Semafor and Haaretz name no one, and Urich's lawyers confirmed the hack without saying who they blame.
[1] [2] -
02
How the attackers got into Urich's WhatsApp.
Semafor says he appears to have exposed it through his AI-built app, and Haaretz ties the leak to the hole it found in his tool, but neither shows that this was the way in.
[1] [2] -
03
Whether every leaked message is genuine.
Haaretz says it verified the leak but has not said how, and Urich's lawyers confirmed a hack, not each message.
[1] -
04
Whether the karaoke records were copied.
Daiichi Kosho says it has not confirmed any theft, and BleepingComputer found no public statement from Nippon Columbia, whose computer held the malware.
[3] -
05
How much data leaked from Switzerland's federal pension fund, and through which supplier.
Publica says the scope is still being worked out, and it has not named the software company that was attacked.
[6] -
06
Which other hidden websites lost their addresses through the GoBalance flaw.
Dread's operator says several markets were hit but gave no names or number, and Omega is the only one named so far.
[5] -
07
How many files the law firms lost.
Holland & Knight speaks of a small number of files and Squire Patton Boggs of a limited set, and neither gives a figure.
[4]
Italy's foreign ministry said its security systems stopped an attack on its website, and its services kept running.
More from Cybersecurity
Across the beats