A hacktivist group calling itself "Cyber Support Front" has claimed a deep intrusion into IMCO, an Israeli defense electronics manufacturer that supplies power systems, battlefield computers, and display units for Merkava tanks and Namer and Eitan armored personnel carriers. Hebrew-language outlets including Israel Hayom and TechTime have reported the incident, and IMCO has reportedly acknowledged that its infrastructure sustained "serious damage." The claimed haul is roughly 30 terabytes, of which about 10 terabytes is characterized as highly sensitive military documentation. The reporting reviewed here reaches Western readers via Tasnim News Agency, an Iranian state-affiliated outlet, so volume and sensitivity figures should be treated as actor claims relayed through interested parties rather than as verified forensic findings.
What Happened
According to the reporting, the intrusion spanned three distinct environments inside IMCO: corporate communication networks, industrial and production infrastructure, and data storage servers. That combination is the detail worth pausing on. Reaching all three implies either lateral movement across a flat or weakly segmented network, or separate footholds established over an extended dwell time. Either interpretation points to an intrusion measured in weeks or months, not hours.
Two secondary indicators support the claim that this was more than a defacement or a smash-and-grab. First, IMCO reportedly stood up a dedicated crisis team and brought in foreign incident response specialists. Organizations do not import external IR capability for contained events. Second, Israeli domestic media formed investigation and review teams around the story rather than dismissing it, which is atypical for the routine inflated claims that circulate in the hacktivist ecosystem around the Israel-Iran conflict.
IMCO is a mid-sized company by headcount, roughly 600 specialized employees, operating seven production facilities in Israel and abroad. That profile matters: a defense contractor with outsized strategic access and a mid-market security budget is exactly the asymmetry attackers hunt for in supply chain targeting.
What Was Taken
The claimed data set breaks down as follows, per the reporting:
Volume. Approximately 30 TB total, with approximately 10 TB classified by the actors as highly sensitive military material.
Manufacturing blueprints. Design documentation for military products, reportedly including systems tied to armored platforms and to missile and air defense programs.
Contracts. Critical contractual documents, which in a defense context typically expose delivery schedules, quantities, subcontractor relationships, pricing, and program names not otherwise public.
Physical surveillance footage. Camera feeds from inside company facilities. This is the single most operationally significant item in the list. Access to internal CCTV means the actors reached OT-adjacent or physical security systems, not merely file shares, and it hands an adversary layout intelligence, shift patterns, and equipment placement inside production sites.
Program exposure. IMCO's role covers electrical systems, battlefield computers, and smart displays for the Merkava, Namer, and Eitan platforms, plus stated involvement in planning for missile and air defense systems. The exfiltrated blueprint material, if genuine, touches ground, air, and missile defense supply chains simultaneously.
Why It Matters
The strategic lesson here is not about IMCO. It is about the tier-two supplier as the path of least resistance into a hardened prime.
Prime defense contractors and defense ministries invest heavily in segmentation, monitoring, and clearance controls. Their component suppliers frequently do not, yet those suppliers hold the same design data, the same program identifiers, and the same delivery schedules. A subsystem vendor for tank displays holds tank internals. A vendor supplying air defense planning holds air defense architecture. The classification of the data does not drop just because the network holding it is cheaper to defend.
Second, the surveillance footage element reframes the incident from data theft to reconnaissance. Interior imagery of defense production facilities has value for kinetic targeting, for insider recruitment, and for validating which programs are actually in production versus announced. In an active regional conflict, that is intelligence with a shelf life measured in operational planning cycles.
Third, hacktivist branding increasingly obscures state-aligned tradecraft. A group that maintains multi-environment access across corporate IT, industrial infrastructure, and physical security systems long enough to move 30 TB is not operating at the skill level implied by the label. Defenders should model "Cyber Support Front" against state-aligned capability, regardless of how the group presents itself.
The Attack Technique
No initial access vector has been disclosed publicly. What the reporting does support is a set of inferences about the intrusion's shape:
Weak segmentation between IT, OT, and physical security. The reported reach into communication networks, industrial infrastructure, and camera systems is the signature of a network where a single foothold escalates into everything. Properly segmented environments require separate compromises for each.
Long dwell time. Moving 30 TB out of an enterprise network is not a quick operation. At a sustained 100 Mbps of exfiltration bandwidth, 30 TB takes roughly a month of continuous transfer. Slower or throttled exfiltration designed to evade detection takes considerably longer. That volume leaving the network without triggering an egress alert is the most concrete detection failure in this incident.
Camera and building system access. Video surveillance platforms and building management systems are recurring soft targets: default or shared credentials, vendor remote access, delayed firmware patching, and exclusion from EDR coverage. They are also frequently reachable from corporate VLANs.
No ransomware component reported. The absence of encryption or extortion mechanics, paired with the intelligence value of the specific data described, suggests collection rather than monetization was the objective. That changes the defender calculus: there may be no ransom note to reveal the intrusion, and dwell time may be ongoing at other targets in the same campaign.
What Organizations Should Do
Defense suppliers and industrial manufacturers should treat this as a prompt for specific, checkable actions:
-
Instrument egress volume, not just egress destinations. Baseline normal outbound data volume per host and per segment, then alert on deviation. A DLP or NDR rule that fires on multi-terabyte cumulative transfers to any destination, including cloud storage and legitimate SaaS, would have surfaced this months before disclosure. Review the last twelve months of netflow data for volume anomalies you did not investigate at the time.
-
Audit the segmentation boundary between IT, OT, and physical security. Enumerate every route from a standard corporate workstation to your CCTV platform, badge system, building management system, and production network. Each reachable path is an unaudited escalation route. Physical security systems in particular belong on isolated VLANs with no inbound path from user networks.
-
Bring surveillance and building systems under real asset management. Inventory every camera, NVR, and controller with firmware version and credential ownership. Rotate default and shared credentials, disable vendor remote access that is not actively required, and place these devices behind an access broker rather than direct network reachability.
-
Classify and locate your design data. Identify where blueprints, CAD files, and program documentation actually live, including engineer workstations, personal shares, and legacy file servers. Apply access controls scoped to individual programs rather than to the engineering department as a whole, and log every bulk read.
-
Extend security requirements down the supply chain contractually. If you are a prime contractor or a ministry, your subsystem suppliers hold your program data. Require segmentation attestation, egress monitoring, MFA on all remote access, and breach notification timelines as contract terms, and verify them rather than accepting self-certification.
-
Retain an IR provider before you need one. IMCO reportedly had to source foreign specialists mid-incident. Pre-negotiated retainers cut days off containment, and days matter when the adversary is still exfiltrating.
-
Hunt for the same pattern now. Assume this actor is running a campaign, not a single operation. Defense suppliers in the region should proactively hunt for anomalous authentication to video and building systems, unexplained archive creation on file servers, and long-lived outbound sessions to cloud storage providers.
Confidence and Caveats
Treat the following as separable claims with different confidence levels. That an incident occurred at IMCO and that the company acknowledged serious infrastructure damage is corroborated by Israeli domestic reporting and is assessed as likely accurate. The specific figures, 30 TB total and 10 TB of highly sensitive military material, originate with the threat actors and reach English-language readers through an Iranian state-affiliated outlet with an interest in maximizing the perceived damage. Hacktivist volume claims are routinely inflated, and no sample or leak site data has been independently validated at the time of writing. The categories of data described are consistent with IMCO's business, but their scope, recency, and classification level remain unverified. Defenders should act on the structural lessons, which hold regardless of the true byte count, rather than on the headline number.
Sources: Cyberattack Hits Israeli Military Supplier IMCO, 30 Tb of Data Stolen - Tasnim News Agency