Handala claims data breach and server destruction at Hebrew University of Jerusalem

• Ransomware group: Handala
• Country: Israel
• Sector: Education
• Announcement date: March 13, 2026

Handala claims massive data theft and destruction at Hebrew University of Jerusalem

The threat actor known as Handala has announced a significant cyber operation targeting the Hebrew University of Jerusalem. According to a claim posted on a leak site on March 13, 2026, the group alleges they have successfully breached the institution's infrastructure, resulting in both the theft of massive quantities of sensitive information and the destruction of critical server systems.

The group's claims suggest a highly destructive attack pattern. Handala asserts that they managed to gain access to all of the university's servers. Beyond the theft of information, the group claims to have wiped 48 terabytes of data from the institution's systems. In addition to this destruction, the group alleges that they have exfiltrated 23 terabytes of sensitive information, which they claim is now in their possession.

Details of the alleged data exfiltration

The scale of the alleged breach is substantial, involving a vast amount of digital assets. While the group claims to have destroyed a significant portion of the university's data, they also claim to have stolen a massive repository of information. The specific types of data the group claims to have exfiltrated include a variety of sensitive categories related to the university's operations and its community:

• Student personal data
• Faculty personal data
• Email correspondence
• Official documents
• Archival data

The exposure of such a wide range of information, from personal identifiers to official institutional records, represents a significant breach of privacy and administrative security.

About the Hebrew University of Jerusalem

The Hebrew University of Jerusalem is a prominent public university located in Jerusalem, Israel. It is recognized as one of the country's most prestigious academic institutions, focusing on both higher education and scientific research.

Analysis and potential implications of the attack

The claims made by Handala carry heavy implications for the affected institution and its community. The alleged theft of personal information belonging to students and faculty members poses a direct risk of identity theft and the execution of targeted phishing attacks against these individuals. Furthermore, the potential exposure of administrative and financial data could lead to significant disruptions in the university's operational continuity.

Given the institution's location in Israel, the incident may result in legal implications under local data protection regulations. The nature of the attack, which involves both data theft and the destruction of systems, suggests a highly disruptive objective. The claim regarding the destruction of university systems implies that any subsequent data recovery efforts by the institution could be protracted and difficult.

The Handala group is assessed to have ties to Iran and utilizes destructive attack methods. Consequently, these actions may be part of a politically motivated cyber warfare campaign. In such scenarios, organizations often face double extortion tactics, where attackers not only encrypt or destroy data but also threaten to leak sensitive information to pressure the victim. This combination of destruction and exfiltration is a hallmark of sophisticated, high-impact cyber operations.

For organizations in the education sector, such incidents highlight the necessity of robust defensive strategies. Implementing comprehensive backup solutions that are stored offline or in immutable environments can help mitigate the impact of destructive attacks. Additionally, strong identity and access management (IAM) protocols are essential to prevent unauthorized access to sensitive student and faculty data. Organizations must also prioritize continuous monitoring and rapid incident response capabilities to detect and contain breaches before they escalate to the level of massive data exfiltration and system destruction.