Tehran Is Fabricating Data Leaks About Israeli Pilots

An alleged hack-and-leak that claims to reveal the names — along with other biographical and professional data — of about 40 Israeli Air Force (IAF) pilots has spread on social media since June 14. The source of the purported leak was not initially clear, as many people posting about it on X did not cite a source, but the Foundation for Defense of Democracies (FDD) traced it back to a newspaper with links to Iran’s Islamic Revolutionary Guard Corps (IRGC).

Closer analysis by FDD shows that the leaked information is almost certainly false or fabricated. The disinformation effort appears to be an attempt by the Iranian regime to convince its people of the government’s cyber skills.

IRGC-Connected Paper Claims 3 Different Leaks

A June 14 article posted on the website of the newspaper Farhikhtegan claims Iranian hackers obtained confidential information on Israeli pilots and shared an image of a spreadsheet containing their names, ages, service status, bases, and model of jet flown. Mohammad Amin Imanjani, an IRGC affiliate, manages the paper.

There is strong circumstantial evidence that the leaked spreadsheet is a fabrication. Fifteen percent of those on the list have the surname Cohen, while only 2 percent of Israelis have that surname. The list shows four active-duty pilots in their 50s, which is possible but improbable, as Israeli military pilots typically retire in their mid-40s.

Farhikhtegan was also the source of a second article on June 15 claiming Iranian hackers had discovered the exact locations of Israeli military bases. The images in the article, however, are available on the Wikipedia pages for Ramon Airbase, Tel Nof Airbase, Ramat David Airbase, and Nevatim Airbase.

This apparent pattern of fabrication also casts doubt on Farhikhtegan’s third “hack-and-leak” article, also from June 15, showcasing purported information about Israeli air defense personnel, including their name, age, service status, base, role, and operational group.

The Purpose of the Purported Leaks: Boosting Morale or Attempt to Intimidate Israelis?

The intended audience for the purported leaks is likely Iranian since they are primarily in Persian and were initially released by a publication meant for Iranian audiences. Iran has exaggerated the impact of cyberattacks in its domestic media in the past to impress its own people. Farhikhtegan’s articles appear to follow this trend.

Opportunistic actors are amplifying the false claims. An hour after Farhikhtegan published its first alleged data leak, an Iranian journalist shared the image on X in an English-language post, and the image then spread rapidly on X. This post includes the original image of the alleged leak, complete with branded logos that say “FARHIKHTEGANONLINE.”

Later posts sharing the image often crudely remove the branded logos, likely to obfuscate the connection to the IRGC-linked outlet and make the faked document look more authentic.

Iran has previously leaked real data on IAF personnel, and it’s possible that the current release may also be intended to stoke fear in the Israeli public.

Exposing Tehran’s Lies Can Embarrass Regime

Farhikhtegan’s efforts may at first seem farcical. However, disinformation intended for domestic audiences constitutes one tool in the Islamist regime’s self-preservation toolbox. For the regime’s supporters, it may help boost morale and make the regime appear more capable of defending itself from Israel’s heavy bombardment.

By debunking Iran’s domestic disinformation through Persian-language social media posts and broadcasts like Radio Farda, America and Israel can attack the regime’s image as well as its physical assets.

Max Lesser is a senior analyst on emerging threats at the Center on Cyber and Technology Innovation (CCTI) at FDD. For more analysis from CCTI and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.