The Handala cyber group, believed to be linked to Iran, has taken responsibility for a significant, renewed attack on the infrastructure of GNS, which it claims is the largest cloud services provider in Israel.

In a statement carried by Iran’s Fars News Agency, the group said it had re-infiltrated the company’s cloud systems and maintained what it called deep, uninterrupted access to its networks over the past 18 months, The Caspian Post reports.

Handala claimed it had gained extensive control over GNS systems, including access to operational and managerial layers of the company. It also alleged that passwords for customers’ virtual machines and servers had been stored in plain text on GNS servers and subsequently extracted and archived.

The group further said that more than 112,000 devices and servers had been “backdoored” and placed under its control over the same period, adding that it had maintained persistent access without detection.

According to Handala, the entire GNS supply chain has been compromised, leaving all customers, including banks, technology firms and individual users, exposed.

The cyber group said the breach was a continuation of a previously declared operation announced in December 2024, which it referred to as “Operation Martyr Reza Awad”.

It also claimed to possess what it described as indisputable evidence of the intrusion, warning that all GNS customers should assume their data and systems have been exposed for an extended period.

Handala said it would publish further details and evidence of the alleged breach at a later stage.

The claims have not been independently verified.