Handala claims data leak targeting Hotam EC

• Ransomware group: Handala
• Country: Ecuador
• Sector: Professional Services
• Announcement date: June 30, 2025

Handala claims a massive data leak against Hotam EC

The threat actor known as Handala has announced a significant data breach involving Hotam EC. According to an announcement made on a leak site on June 30, 2025, the group claims to have successfully exfiltrated a large volume of sensitive information belonging to the organization. The group asserts that the total volume of the allegedly leaked data amounts to 226 GB.

In modern cyberattack landscapes, such announcements are often part of a double extortion strategy. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release confidential information on public leak sites, attackers aim to pressure victims into paying ransoms to prevent the exposure of proprietary or personal data. This method increases the pressure on organizations, as the damage from a data leak can persist long after a system has been restored from backups.

Details of the alleged intrusion

The Handala group claims that it gained unauthorized access to the infrastructure of Hotam EC on June 30, 2025. The group asserts that during this breach, they were able to access and duplicate a wide range of data from the organization's internal systems. The claims suggest a deep level of access, spanning from routine internal communications to highly sensitive financial and operational models.

The scope of the alleged theft is extensive. The group claims to have acquired various types of data that are critical to the organization's daily operations and strategic planning. The specific types of data allegedly stolen include:

• Internal communications
• Client portfolios
• Decision-support models
• Risk-control systems
• Investor data
• Proprietary technologies
• Compliance logs

The exposure of such a diverse dataset suggests that the attackers targeted the core functional layers of the organization, moving beyond simple file theft to targeting the very tools used for decision-making and risk management.

Potential implications and risks

The claims made by Handala could have profound consequences for Hotam EC. The exposure of investor information and risk-control systems specifically poses a threat to the institution's competitive advantage, as it could lead to the leakage of trade secrets. Furthermore, the breach may negatively impact the institution's operational continuity and the level of trust held by its clients.

Because Hotam EC is based in Ecuador, the alleged leak introduces significant legal risks regarding compliance with local data protection regulations. Additionally, there is a secondary risk that the stolen data could be utilized by malicious actors for identity theft or to launch highly targeted phishing attacks against the organization's clients or employees. Given that the Handala group is known to have ties to Iran and is associated with disruptive attacks, this incident is assessed as potentially being more than a simple data leak; it may represent a deliberate attempt at sabotage against the corporate infrastructure.

Defensive considerations for professional services

For organizations operating in the professional services sector, protecting sensitive client and investor data is paramount. To mitigate the risks of data exfiltration and subsequent extortion, companies often implement multi-layered security frameworks. This includes robust identity and access management (IAM) to ensure that users only have access to the data necessary for their roles, and strict monitoring of data movement to detect unauthorized transfers of large volumes of information.

Furthermore, organizations can benefit from implementing strong encryption for data at rest and in transit, ensuring that even if data is exfiltrated, it remains unreadable to unauthorized parties. Regular security audits, comprehensive logging of compliance and system access, and proactive threat hunting are also essential components of a modern defensive posture designed to identify and stop intruders before they can complete their objectives.