Handala claims Doscast data breach involving millions of records

• Ransomware group: Handala
• Country: Israel
• Sector: Retail & E-Commerce
• Announcement date: October 10, 2024

Handala claims Doscast data breach

The threat actor group known as Handala has announced the publication of data they claim belongs to the Doscast platform. According to the announcement made on a leak site, the group asserts that they have obtained a significant volume of information belonging to the organization.

The group claims that the leaked data consists of 3 million records, which they suggest affects more than 100,000 users. This announcement was made on October 10, 2024, the same date the group claims the attack occurred. To support their claims, the group provided a sample database dump in the announcement, which contains a portion of the alleged stolen data.

Details of the claimed data leak

Based on the screenshots provided in the announcement, the leaked information includes various personal identifiers. The sample data displayed by the group includes the following types of information:

• Email addresses
• Names
• Gender information
• Dates of birth
• Phone numbers

The presence of such sensitive personal information in a public leak can lead to significant secondary risks for the affected individuals. These risks include the potential for identity theft and the execution of highly targeted phishing attacks, as attackers can use specific details like names and dates of birth to appear more legitimate in fraudulent communications.

About Doscast

Doscast is a digital platform designed to provide content specifically for the ultra-Orthodox Jewish community. The service features a wide variety of podcasts and audio broadcasts intended for a diverse audience. Users access the platform's extensive library of audio content through both a dedicated website and a mobile application, which is designed to serve the needs of the whole family.

Analysis and organizational implications

The nature of this incident suggests it may be an ideologically motivated action rather than a standard data breach. The Handala group is assessed to have links to Iran and is known for conducting disruptive cyber activities against Israel. Given that the Doscast platform is based in Israel, the processing and exposure of this data may be subject to relevant Israeli data protection regulations.

In such scenarios, organizations often face the challenges associated with double extortion tactics. In these types of attacks, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it unless a ransom is paid. This approach increases the pressure on the victim, as the threat of public exposure remains even if systems are restored from backups.

For organizations operating in the digital media and retail sectors, such incidents highlight the necessity of robust security frameworks. Defensive measures typically include implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication across all user and administrative accounts, and maintaining rigorous patch management schedules to close vulnerabilities. Furthermore, organizations are often advised to conduct regular security audits and implement comprehensive monitoring to detect unauthorized access early. Following a breach, it is common practice for organizations to review their security measures and notify affected users to mitigate the impact of potential identity theft or phishing attempts.