Handala claims data breach against Zacharia Levi Ltd

• Ransomware group: Handala
• Country: Israel
• Announcement date: June 21, 2025

Handala claims to have exfiltrated data from Zacharia Levi Ltd

The threat actor group known as Handala has announced a data breach targeting Zacharia Levi Ltd, an organization based in Israel. In an announcement posted on a leak site on June 21, 2025, the group claimed to have successfully infiltrated the servers of the company. This incident is characterized as a data leak, with the group asserting they have gained unauthorized access to sensitive corporate information.

Details of the alleged infiltration

According to the claims made by Handala, the group successfully breached the server infrastructure of Zacharia Levi Ltd on June 21, 2025. The group asserts that they have extracted the company's entire database. This alleged theft includes a wide range of sensitive information intended to impact the organization's operations and privacy.

The group claims to possess a vast collection of internal documentation and private communications. This includes not only administrative and financial records but also highly sensitive technical assets. The scope of the alleged theft suggests a deep level of access into the company's digital environment, targeting both corporate data and the private communications of its leadership.

The scope of the claimed data theft

The Handala group claims to have stolen approximately 20 GB of data. The specific types of information the group asserts they have in their possession include:

• Project information
• Contracts
• Customer records
• Financial documents
• Corporate communications
• Technical blueprints

The group further claims to have access to internal communications and the private emails of senior executives, alongside technical blueprints related to both ongoing and future projects.

Analysis and potential impact

The alleged data breach may pose significant risks to the organization's operational continuity and commercial reputation. The exposure of customer records and financial documents could potentially lead to identity theft or targeted phishing attacks against the affected individuals. Furthermore, the leakage of technical blueprints could potentially compromise supply chain security.

Given the company's location in Israel, legal proceedings under local data protection regulations may be initiated. As the Handala group is assessed to have links to Iran and focuses on Israel-based targets, this incident may be part of a politically motivated cyber operation. This type of activity is common in the current threat landscape, where threat actors often target specific regions or sectors to achieve political or ideological objectives.

In such scenarios, organizations often face the challenges of double extortion, a tactic where attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to pressure the victim into paying a ransom. To defend against such threats, organizations typically implement multi-layered security strategies. These include robust access controls, regular security awareness training for employees to prevent phishing, and comprehensive monitoring of network traffic to detect unauthorized exfiltration. Additionally, maintaining offline, immutable backups is a critical component of a modern incident response and recovery strategy to ensure business continuity in the event of a successful breach.