Executive Summary
Publication Date: October 25, 2026
In late October 2026, a critical cybersecurity incident involving Partner, one of Israel’s largest telecommunications providers, was publicly disclosed by TheMarker. The incident centered on the exposure of thousands of private MMS (Multimedia Messaging Service) messages, including sensitive images and personal communications, due to the abandonment and subsequent takeover of a domain previously used by Partner for MMS routing. A security researcher, after acquiring the expired domain, began receiving live MMS traffic intended for Partner customers. Despite multiple responsible disclosure attempts to both Partner and the Israeli National Cyber Directorate, no action was taken until the issue was escalated by the media. This event highlights the severe risks associated with poor domain lifecycle management and the critical importance of robust incident response processes.
Technical Information
The incident originated from the expiration and non-renewal of a domain integral to Partner’s MMS infrastructure. This domain, once responsible for receiving and routing MMS messages for Partner subscribers, was left unregistered and subsequently acquired by an independent security researcher. Upon acquisition, the researcher observed a continuous influx of MMS messages, many containing highly sensitive personal data, including photographs, private conversations, and metadata such as sender and recipient phone numbers.
Root Cause Analysis
The technical root cause was the failure to renew a domain that served as an endpoint for Partner’s MMS gateway. In typical MMS architectures, when a user sends an MMS, the message is routed through a carrier’s gateway, often using HTTP/S protocols to deliver the payload to a domain-controlled endpoint. If such a domain lapses and is registered by a third party, all subsequent MMS traffic is redirected to the new owner, resulting in a catastrophic breach of confidentiality.
This scenario is a textbook example of a domain takeover vulnerability, where the security of an entire service hinges on the continued ownership of a specific domain. The risk is exacerbated in telecommunications, where legacy protocols like MMS are still widely used and often overlooked in modern security audits.
Impact Assessment
The impact of this incident was profound. The researcher received thousands of live MMS messages, each potentially containing sensitive personal information. The exposed data types included:
Personal images and videos, private text messages, sender and recipient phone numbers, and associated metadata such as timestamps and device identifiers.
The breach affected all Partner customers utilizing MMS services during the period in which the domain was under third-party control. The scale of the exposure, combined with the sensitive nature of the data, represents a significant privacy violation and a potential vector for further exploitation, including blackmail, identity theft, and targeted social engineering attacks.
Exploitation Methodology
The exploitation vector was straightforward yet devastatingly effective. Upon expiration, the MMS gateway domain was registered by the researcher, who then configured it to receive all incoming traffic. Because the Partner MMS infrastructure continued to route messages to the now third-party domain, the researcher was able to intercept all MMS communications intended for Partner customers.
This method is classified under the MITRE ATT&CK technique T1584.001 – Acquire Infrastructure: Domains, where an attacker acquires a domain previously used by the target organization to intercept or manipulate traffic. The delivery of MMS messages over standard web protocols (HTTP/S) aligns with T1071.001 – Application Layer Protocol: Web Protocols. If any authentication tokens or credentials were embedded in the MMS payloads, there is potential for further exploitation via T1110.003 – Brute Force: Credential Stuffing.
Timeline of Events
The sequence of events unfolded as follows: The MMS gateway domain expired and was subsequently registered by the security researcher. The researcher began receiving live MMS traffic, immediately recognizing the sensitivity of the intercepted data. Multiple responsible disclosure attempts were made to both Partner and the Israeli National Cyber Directorate, but these were ignored. Only after the issue was reported by TheMarker did Partner take action to remediate the vulnerability by updating their MMS infrastructure and ceasing traffic to the compromised domain.
Affected Products and Services
The vulnerability was architectural and operational, not tied to a specific software or hardware version. All Partner mobile devices and customer accounts capable of sending or receiving MMS messages during the period of domain abandonment were affected. The compromised service was the Partner MMS gateway, which relied on the now-expired domain for message routing.
Indicators of Compromise (IOCs)
The primary IOC is the now-reclaimed MMS gateway domain previously owned by Partner. Any traffic directed to this domain during the period of third-party ownership should be considered compromised. Additional IOCs include logs of MMS messages, images, and phone numbers routed through the affected domain.
Threat Actor Analysis
While this incident was not attributed to a specific Advanced Persistent Threat (APT) group, domain takeover is a well-documented technique employed by groups such as APT28 (Fancy Bear) and APT29 (Cozy Bear) for phishing, data interception, and infrastructure hijacking campaigns. The benign nature of the researcher’s actions in this case does not diminish the potential for malicious exploitation had the domain been acquired by a threat actor.
Public Disclosure and Response
The incident was first reported by the security researcher, who attempted responsible disclosure. The lack of response from both Partner and the Israeli National Cyber Directorate underscores a critical gap in incident response and vulnerability management processes. The vulnerability was only remediated after media intervention, highlighting the importance of transparent and responsive security practices.
Mitigation Strategies
To prevent similar incidents, organizations must implement comprehensive domain lifecycle management. This includes maintaining an up-to-date inventory of all operational domains, enabling automated renewal for critical domains, and establishing monitoring for domain expiration and DNS changes. Regular audits of legacy services, such as MMS gateways, are essential to identify and decommission obsolete infrastructure. Furthermore, organizations must develop robust incident response protocols to ensure timely action on responsible disclosures.
Lessons Learned
This incident serves as a stark reminder of the risks posed by abandoned digital infrastructure. The continued reliance on legacy protocols like MMS, combined with inadequate domain management, creates significant vulnerabilities. Organizations must prioritize the security of all assets, including those perceived as low-risk or obsolete, to prevent similar breaches.
References
TheMarker Original Report (Hebrew): https://www.themarker.com/technation/2026-10-25/ty-article/.premium/000001a1-6321-d5c9-adad-f37510cf0000
Domain Takeover Risks – OWASP: https://owasp.org/www-community/attacks/Subdomain_takeover
MITRE ATT&CK T1584.001: https://attack.mitre.org/techniques/T1584/001/
Similar Incidents: Subdomain Takeover in the Wild – HackerOne: https://www.hackerone.com/blog/Guide-Subdomain-Takeovers
Rescana is here for you
At Rescana, we understand the complexities and evolving nature of third-party risk in today’s digital landscape. Our advanced TPRM platform empowers organizations to continuously monitor, assess, and manage their external attack surface, ensuring that vulnerabilities like domain takeovers are identified and mitigated before they can be exploited. We are committed to helping you safeguard your digital assets and maintain the trust of your customers and partners. For any questions or further information, please contact us at info@rescana.com.
