Haaretz Called Tzachi Braverman’s Contact Dump a Data Leak as Prosecutors Moved to Charge Him Over a Different Secret in the Gaza War
Handala said it owned Tzachi Braverman’s phone. What it put on the internet on December 28, 2025, looked like photographs, office paper, and a contact book. Israel’s Prime Minister’s Office answered with a sentence small enough to drive a truck through: no indications, at that stage, that the mobile itself was compromised, investigation continuing. Weeks later the office told Haaretz something tighter. It appeared to be a data leak, not a phone hack. Those are not the same claim. A backup, a paired laptop, a staffer’s cloud, or a synced messaging app can bleed a directory without the handset ever leaving a pocket. Headlines said phone hack. The office said device status unknown-to-clean. The graph of names is the object that matters, and the graph did not stay a December problem.
Braverman was the man who decided who reached Benjamin Netanyahu, and he had just been approved as ambassador-designate to Britain. A book like that is a map of the prime minister’s door. The AEGIS Alliance treated the drop as the second product in a campaign that opened with a poem about the Florida flight. This page is about the book, and about the fact that the same gatekeeper later became a criminal defendant in a different leak, one his own government says he tried to shut down.
What was posted, and what was only promised
Handala’s copy called the dump “The Gatekeeper’s Fall” and told Netanyahu’s circle that every layer of security had already failed. It teased 110 pages of contacts on the first night. It claimed instant messages, email, and proof of “vile financial and moral acts,” including extortion and bribery. Calcalist read the first batch and said the files did not substantiate that caption. The visible material looked like a directory, videos of Braverman at events, unclassified notices, and thin correspondence. The group also said it had emailed the archive to former prime minister Naftali Bennett, who brought in security officials and told his circle not to make political use of “products of the Iranian attack, should they be received.”
The Jerusalem Post carried the denial the same day. i24, Israel Hayom, and Ynet carried the screenshots. None of them is a laboratory. The public still does not have a letter that says this file came off this IMEI at this hour. What the public does have is Haaretz’s January reconstruction: roughly 2,400 contacts from Braverman’s book, plus lists tied to Bennett and to former justice minister Ayelet Shaked, including security officials and foreign names. Dozens of the Braverman entries were saved with notes that marked sensitive roles. Haaretz left open whether Handala had touched the devices or had reached cloud copies of WhatsApp and Telegram, which store contacts, images, and video without the phone itself being in an adversary’s hand. That is the distinction the Prime Minister’s Office was reaching for, and it does not make the numbers harmless.
A graph is worth more than a trophy phone
Intelligence work is often just graph paper. Who can reach the prime minister. Whose personal line sits one hop off that desk. Which foreign official, donor, or journalist is saved next to a security chief. A dump that names those edges stays useful after the screenshots stop circulating. It is useful to an adversary building a target list. It is useful to a criminal writing a spear-phish. It is useful to anyone who wants to know the shape of a government that does not publish its own org chart.
The Braverman claim did not arrive alone. On December 18 Handala said it had Bennett’s phone and published chats plus a long contact list. Bennett’s answer was specific: Telegram, not the handset. On January 3, 2026, the group posted about 60 photos and videos it attributed to Shaked. On January 8 it claimed surveillance of a senior Mossad officer. On February 25 it said it had released medical records of more than 10,000 Clalit patients. In July, The Times of Israel reported a trove the group attributed to former military chief Herzi Halevi, including family photographs and identity cards. Each post is its own authentication problem. Together they are a method. Announce a brand. Drip enough true-looking material to make the next official wonder which of his lines is already gone. The International Institute for Counter-Terrorism called Bibi Gate a mask for Iranian psychological warfare. That reading fits a real leak. A service that wants panic does not need every transistor in a chief of staff’s pocket. It needs enough true numbers to make the denial sound small.
The other leak, the one prosecutors say he tried to kill
The phone book is not the only secret that left Braverman’s orbit. On May 26, 2026, Attorney General Gali Baharav-Miara moved to charge him, pending a hearing, with fraud, breach of trust, and obstruction of justice. The Times of Israel and The Jerusalem Post tied the suspicion to an October 2024 midnight meeting in a car at the Kirya, the military headquarters in Tel Aviv. Prosecutors say Braverman had learned of a covert investigation into a top-secret intelligence item passed to the German tabloid Bild, met media adviser Eli Feldstein, read names off a paper, and said that if the probe was “connected to us” he could shut it down. Feldstein was later indicted over the Bild leak. Braverman’s lawyers say the case rests on a dishonest witness who gave contradictory versions. Braverman denies wrongdoing. A hearing is not a conviction.
The two leaks should not be mashed together. Handala is an Iran-tied crew dumping a directory and daring Israel to call it fake. The Bild case is an Israeli prosecution about classified material allegedly used, during the war in Gaza, to argue that Hamas rather than Netanyahu was blocking a hostage deal. Jewish News reported that Braverman was arrested in January 2026 in that probe. By May, Israeli coverage described him both as chief of staff and as the former chief of staff still designated for London. The point of printing them on one page is not that the hackers and the prosecutors share a file. It is that the office which lost a contact book was already an office accused of treating secrets as a political tool in a war that legal scholars, UN experts, and medical charities have called a genocide.
Why the denial does not retire the graph
A state fighting that war has killed tens of thousands of Palestinians, pushed international doctors out of Gaza over a staff-list demand, and still has to explain how its gatekeeper’s numbers reached an adversary. The AEGIS Alliance has kept that Gaza record in the aid-group ban and in the ceasefire-strike rebuke from Qatar, Egypt, and Jordan. A crew that brands itself as a voice for Palestinians does not get a pass on unverified PDFs. A government that runs the bombardment does not get to answer a 2,400-name exposure with the word “indications.”
The correct status line is still the boring one. Claimed. Denied as a handset compromise. Redescribed by the Prime Minister’s Office as a data leak. Partially corroborated by a newspaper reconstruction of contact lists. Not closed by a hash. Separately, the same man is facing a pre-indictment hearing over an alleged attempt to smother a classified-leak investigation. Readers who want the technical file can stay with The AEGIS Alliance hacker news desk. Readers who want the political file can stay with international news. The trophy phone was never the story. The graph was. The hearing is the reminder that the graph’s owner was already standing in more than one leak.
