Handala claims data breach against TBN Israel

• Ransomware group: Handala
• Country: Israel
• Sector: Technology
• Announcement date: June 16, 2025

The threat actor known as Handala has published a leak announcement claiming to have successfully infiltrated the internal systems of TBN Israel. According to the announcement released on June 16, 2025, the group alleges that they have compromised the organization and subsequently released a significant volume of data.

The claims made by Handala

The threat actor known as Handala published a leak announcement on June 16, 2025, claiming to have compromised the systems of TBN Israel. In the announcement, the group alleges that the organization operates as a propaganda arm under the guise of religious broadcasting. Furthermore, the group asserts that they have obtained documents that reveal connections between the network's leadership and Israeli security services.

This type of activity is often associated with politically motivated threat actors who use data breaches to further specific agendas. In such scenarios, the release of stolen information is used to damage the reputation of the target or to spread specific narratives. The group's claims suggest a focus on exposing alleged hidden connections between the media entity and security apparatuses.

Details of the alleged data leak

The group provided a screenshot as part of their announcement, which claims a data dump totaling 542 GB. This volume of data is said to include various sensitive internal materials belonging to the organization. The specific types of data the group claims to have obtained include:

• Internal corporate communications
• Management documents

The group has not provided information regarding a ransom demand. In many modern cyberattacks, particularly those involving double extortion, threat actors may steal sensitive data and then demand payment to prevent its public release or to decrypt the systems. While the group has claimed the theft of 542 GB of data, the specific file count was not provided in the announcement.

About TBN Israel

TBN Israel is a media organization that operates as the Israel-based broadcasting arm of the Trinity Broadcasting Network. The organization is primarily known for providing religious-themed programming to its audience.

Analysis and potential impact

The Handala group is assessed to have ties to Iran and primarily targets Israeli organizations. This breach may compromise the organization's operational security and increase the risk of targeted phishing attacks against employees and associated parties. Because the group's actions appear to be politically motivated, there is a risk that the leaked data could be utilized in disinformation campaigns, which may cause significant reputational damage to the institution.

Additionally, the organization may face legal obligations under Israeli data protection regulations following the alleged exposure of internal documents and communications. When organizations face such breaches, they often must navigate complex regulatory frameworks regarding the notification of affected parties and the management of data privacy risks.

Defensive considerations for media organizations

For organizations operating in the media and broadcasting sector, maintaining robust cybersecurity posture is essential to protect internal communications and management integrity. Common defensive steps include implementing strict access controls to limit the exposure of sensitive documents and employing multi-factor authentication to prevent unauthorized system access. Furthermore, organizations can benefit from continuous monitoring of their networks to detect anomalous activity that might indicate an ongoing infiltration. Training employees to recognize phishing attempts is also a critical component of a comprehensive defense strategy, especially when threat actors aim to use stolen information for targeted social engineering attacks.