Handala claims data breach against Israel Police

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: February 9, 2025

The threat actor known as Handala has announced a significant data breach targeting the Israel Police. According to a post made on a leak site on February 9, 2025, the group claims to have successfully exfiltrated a massive volume of data belonging to the national police force of the State of Israel.

Details of the alleged attack

The Handala group announced on February 9, 2025, that it had gained unauthorized access to the digital infrastructure of the Israel Police. The group claims to have exfiltrated a total of 31 terabytes of data, consisting of approximately 250,000 files, from the institution's internal systems. The announcement accompanying the claim includes screenshots and download links that are said to contain the compromised data.

The screenshots shared in the group's post appear to show files that allegedly belong to the institution's database management systems and various personnel records. This type of activity is often associated with double extortion tactics, where threat actors not only encrypt an organization's data but also steal it to pressure the victim into paying a ransom by threatening to leak the information publicly.

The data allegedly involved

The leaked data is said to include highly sensitive information related to the institution's staff and operations. The specific types of data mentioned in the claim include:

• Personal personnel records
• Medical records
• Psychological profiles
• Weapon permits
• Identification information

The Israel Police

The Israel Police is the national police force of the State of Israel. It serves as the primary government agency responsible for maintaining public order, combating crime, and ensuring the safety of citizens across the country.

Analysis and implications

This action by the Handala group may be considered part of its ongoing cyber operations targeting Israeli state institutions. Given the sensitivity of the leaked data, it is plausible that the institution's personnel could be at risk of identity theft and targeted phishing attacks. Furthermore, such a leak may lead to questioning Israel's national security protocols and could create perceptions that the institution's operational security has been compromised.

The assessments regarding the group's alleged ties to Iran suggest that the motivation behind the attack may be political and disruptive. The incident may have long-term implications for Israel's data protection regulations and the cyber defense strategies of its state institutions.

In the broader context of cyber threats against government and defense sectors, such incidents highlight the critical importance of robust security frameworks. Organizations in this sector often face highly motivated adversaries whose goals may extend beyond financial gain to include political disruption or espionage. To defend against such threats, organizations typically implement multi-layered security strategies, including strict access controls, continuous monitoring of network traffic, and comprehensive encryption for data at rest and in transit. Additionally, regular security audits and incident response drills are essential for maintaining operational resilience in the face of evolving cyber threats.