Employees across Israel's cybersecurity industry navigated an emotional, anxiety-ridden landscape as they attempted to keep their businesses operating normally this week.

The big picture: Executives at cybersecurity companies with a presence in Israel told Axios their offices have hardly shifted their workflows or development deadlines since Hamas' surprise attack.

• Companies don't foresee the ongoing conflict hurting their sales and revenue numbers.

Yes, but: As many of these employees and executives described unaffected business operations, their surroundings showed the anxiety and challenges that war brings.

• As he was talking with Axios, one person's phone flooded with alerts that missiles were targeting a region his family lived in.
• Executives were interrupted by their children — whose schools are currently closed — running in to ask questions.
• And another source started a call by warning of the chance he'd have to leave if a siren started wailing.

What they're saying: "It's part of life for an Israeli company," Sharon Eilon, chief customer officer at Aqua Security, told Axios.

• "It's not foreign to us; it's all geared around when these things, like now, are happening," he added. "We're in it, and we know how to deal with it."

Zoom out: Israel's cybersecurity sector was already having a difficult year.

• Macroeconomic conditions and political strife had prompted drop-offs in venture capital funding to Israeli companies and led roughly 70% of Israeli startups to relocate parts of their businesses.

Between the lines: The engineering and research teams of many Israeli cybersecurity companies are headquartered in Israel, while their marketing and sales teams are based elsewhere around the world, executives told Axios.

• At startup Cybersixgill, that means most customers aren't seeing disruptions because they typically interact with the overseas sales and marketing teams, CEO Sharon Wagner said.

Zoom in: Those employees in Israel have a growing list of challenges that their employers are hoping to assist with.

• Check Point Software Technologies, a global cybersecurity company with a significant presence in Israel, has started a fund to help employees relocate to safer places or meet other needs, Gil Messing, the company's chief of staff, told Axios.
• Wagner said his company is planning to have a day where employees can bring their kids to work once the company returns to the office to help alleviate any lingering child care stress.
• Check Point has also contracted out a mental health crisis line for employees to call, Messing added.

Meanwhile, employees are being drafted into the Israeli military's reserve service.

• About 15 of Cybersixgill's 100 employees have either been brought into the reserves or have significant others who were drafted, Wagner said.
• Roughly 20 of Aqua Security's 200 employees in Israel have been drafted, Eilon said.

The intrigue: Companies that were already operating remotely or in a hybrid model are having an easier time transitioning to workers' current needs, Messing said.

The bottom line: Much like other industries in the region, Israeli cyber companies are navigating a dual reality: maintaining a sense of business as usual while confronting the trauma of working in war.

• "We strongly believe that a strong nation is not only a strong army, but it's a strong economy," Wagner said.

Politically motivated hackers continued to launch mostly low-level website takedowns and homepage defacements as the war between Israel and Hamas carried on this week.

Why it matters: Cyberattacks and cyber threats are adding to the ever-growing confusion and anxiety that people on the ground have been wrestling with since Saturday.

Threat level: While most of the attacks don't have a notable impact, these hacking groups are starting to incorporate data theft and more destructive elements into their schemes, Gil Messing of Israeli tech company Check Point Software Technologies said.

• The primary example is a cyberattack on Ono Academic College in Kiryat Ono, Israel, where hackers have already shared 250,000 stolen records in a Telegram group. Messing said the school had to briefly take down its networks to recover and assess the damage.
• Messing also told Axios that hackers were able to access two billboards in Tel Aviv and show anti-Israel, pro-Hamas footage for a few minutes this week.

Details: So far, here's what security researchers have noticed throughout the first week of the war.

• Many Israeli citizens started receiving text messages this week from Yemen phone numbers with threatening messages and phishing links, Messing said.
• Cybercriminals are trying to sell databases allegedly from the Israel Defense Forces, according to researchers at ZeroFox.
• RansomedVC, a ransomware gang, posted on its dark-web leak site on Thursday that it's actively seeking "access on Gaza countries and Iran" to support Israel, according to a post seen by Axios.

What's next: Political hacking activity tends to come in waves, with one peak in attacks coming at the very beginning of a conflict.

• Some groups have also threatened to carry out more serious attacks, such as taking down critical infrastructure and deploying ransomware.

The total number of data breaches and leaks in 2023 so far has already outpaced last year's numbers, according to new data from the Identity Theft Resource Center.

By the numbers: Through September, the ITRC tracked 2,116 data compromises — a 17% increase from the 1,802 total compromises tabulated in 2022.

• The total in 2023 so far is the highest annual number the ITRC has compiled since at least 2017, per the report.

Why it matters: The new data suggests that companies and government regulators' attempts to squash the ransomware attacks and other cyberattacks plaguing organizations have hardly made a dent.

• The ITRC found that much of this year's rise can be attributed to a combination of increasing ransomware attacks, so-called zero-day vulnerabilities and supply chain cyberattacks.

What they're saying: "While setting a record for the number of data breaches is attention-grabbing, unfortunately, it is not surprising," Eva Velasquez, ITRC's president and CEO, said in a statement.

• "Now that we have broken the previous annual data compromise record, the question remains: by how much?"

The intrigue: While the total number of compromises has increased, the number of victims in 2023 is dramatically lower than last year's.

• So far in 2023, 233.9 million people have been affected by data breaches and leaks — compared to 425 million in all of 2022.

Between the lines: Attacks tied to a vulnerability in the popular file-transfer tool MOVEit accounted for three of the five most impactful breaches in the third quarter, the report found.

@ D.C.

🚱 The Environmental Protection Agency is withdrawing its new cybersecurity rule for water systems following a GOP-led lawsuit. (The Messenger)

🧐 The European Union is investigating allegations that X is spreading disinformation about the war between Hamas and Israel. (Axios)

@ Industry

🗂 Progress Software said in its quarterly report this week that it is facing a Securities and Exchange Commission investigation over a vulnerability that hackers exploited. (TechCrunch)

🧬 23andMe is facing a class-action lawsuit over a recent leak of user data. (Gizmodo)

💻 Israeli cybersecurity companies are starting to provide free cyber defense services to local companies amid heightened political cyberattacks during the war. (Reuters)

@ Hackers and hacks

🪙 Cryptocurrency-tracing firm Elliptic believes the attackers who stole more than $400 million from FTX the same day it declared bankruptcy are linked to the Russian cybercrime world. (Wired)

🐛 Highly anticipated bugs in a widely used piece of open-source software released this week actually weren't as consequential as anticipated. (CyberScoop)

For the D.C. crowd: Axios D.C. has the review of McDonald's version of mumbo sauce that we've all been waiting for. 🎉💪🏻