Ben Horin & Alexandrovitz Ltd targeted by Handala ransomware group

• Ransomware group: Handala
• Country: Israel
• Sector: Professional Services
• Announcement date: June 22, 2025

Handala claims a massive data breach at Ben Horin & Alexandrovitz Ltd

The threat actor known as Handala has published an announcement on its leak site claiming to have successfully breached the network of Ben Horin & Alexandrovitz Ltd. According to the claims made by the group, the attack resulted in the exfiltration of a massive volume of internal data and the neutralization of the organization's digital infrastructure.

This incident follows a pattern often seen in modern cyberattacks where threat actors target high-profile professional services firms to maximize the impact of their operations. In this instance, the group has provided samples of the alleged stolen data to serve as proof of their successful intrusion into the firm's systems.

The claims made by the Handala group

On June 22, 2025, the Handala group released a statement alleging they had gained unauthorized access to the networks of Ben Horin & Alexandrovitz Ltd. The group's claims extend beyond mere data theft; they allege that the firm's servers were wiped and that their operational systems were neutralized during the course of the attack.

Furthermore, the threat actor has made specific political allegations regarding the victim. Handala claims that Ben Horin & Alexandrovitz Ltd maintains strategic ties with various Israeli state institutions and intelligence units. By making these claims, the group attempts to frame the cyberattack within a broader geopolitical context. Given the group's alleged ties to Iran, it is possible that these leaks are part of a politically motivated disinformation campaign designed to cause reputational damage.

Details of the alleged data theft

The scale of the data breach claimed by Handala is significant. The group asserts that they have successfully exfiltrated a vast amount of internal information from the organization. The specific details provided in the announcement include:

• A total of 11 terabytes of internal data
• Samples of over 50,000 documents provided as proof of concept

The group has utilized these samples to substantiate their claims of a successful breach. While the specific contents of every document are not detailed, the sheer volume of data mentioned suggests a deep penetration into the organization's file servers and internal repositories.

About Ben Horin & Alexandrovitz Ltd

Ben Horin & Alexandrovitz is a prominent firm based in Israel, specializing in professional services such as public relations, strategic communications, and crisis management. The company provides a wide range of services to its clients, including media management, the shaping of public opinion, and strategic consulting. Because the firm serves corporate clients and various other organizations, its data often contains sensitive information related to communication strategies and client relations.

Analysis and potential risks for the organization

The claims made by the Handala group pose a significant risk to the operational continuity of Ben Horin & Alexandrovitz Ltd. If the allegations regarding the wiping of servers and neutralization of systems are accurate, the organization faces immediate challenges in restoring its digital operations. Furthermore, the nature of the alleged stolen data introduces an increased risk of identity theft or targeted phishing attacks directed at the firm's employees and business partners.

Because the firm is based in Israel, this incident may trigger legal proceedings under local data protection regulations regarding the handling and protection of sensitive information. Additionally, Handala is known for employing double-extortion tactics. In such scenarios, threat actors not only encrypt or destroy data but also threaten to release it publicly to increase pressure on the victim. This tactic often leads to a continuous cycle of leaks intended to maximize psychological and reputational damage.

Organizations in the professional services sector can mitigate such risks by implementing robust defensive measures. These include maintaining offline, immutable backups to recover from system wipes, implementing strict network segmentation to prevent lateral movement, and conducting regular security awareness training to protect employees against the phishing attacks that often follow a data leak. Continuous monitoring of network traffic can also help in detecting the exfiltration of large data volumes before the breach is completed.