Handala claims to have breached Tosaf and disabled industrial control systems

• Ransomware group: Handala
• Country: Netherlands
• Sector: Manufacturing
• Announcement date: February 2, 2025

The Handala ransomware group has announced a data breach involving the manufacturing company Tosaf. According to the group's claims, they have successfully breached the systems of the organization and have taken steps to disable its industrial control systems.

The claimed attack and operational disruption

The threat actor known as Handala claims to have compromised the systems of Tosaf on February 2, 2025. The group alleges that this intrusion has resulted in the halting of facility operations. Beyond mere data theft, the group claims to have wiped industrial control systems and blocked access points to the facility, effectively disrupting the physical operational environment.

To support these claims of operational interference and system compromise, the group has shared various screenshots. These images reportedly include facility floor plans, industrial control panel interfaces, and device management screens, which the group uses as evidence of their level of access within the organization's infrastructure.

Affected data and evidence provided

While the specific volume of data or the exact number of files stolen have not been disclosed by the group, the leak site announcement indicates that the breach involves sensitive technical and operational information. The group has provided evidence through screenshots that highlight the following types of affected data:

• Industrial control system data
• Facility floor plans

The presence of such technical data, including control panel interfaces and device management screens, suggests that the attackers gained visibility into the internal workings of the production environment.

About Tosaf

Tosaf is a global company that manufactures masterbatches and additives for the plastics industry. Headquartered in Israel, the firm operates an extensive international network of production and distribution facilities.

Analysis and industry implications

This incident may pose a significant risk to the operational continuity of an organization operating within the manufacturing sector. Given that the Handala group is assessed to have links to Iran and is known for conducting disruptive attacks targeting Israeli interests, this event could be a politically motivated action.

The unauthorized access to industrial control systems is particularly concerning, as it may lead to disruptions in production processes and potential long-term technical issues. Furthermore, because the organization is based in the Netherlands, this incident could trigger regulatory scrutiny and potential administrative penalties under the General Data Protection Regulation (GDPR). There is also a possibility that the leaked technical data could be utilized by the threat actors for secondary attacks in the future.

In the broader context of cyber threats, ransomware groups often utilize double extortion tactics, where they not only encrypt data but also threaten to leak sensitive information to pressure organizations into paying a ransom. When attacks target industrial control systems (ICS), the impact shifts from purely digital data loss to physical operational disruption, which can have cascading effects on supply chains. Organizations in the manufacturing sector often implement defensive strategies such as network segmentation to isolate industrial networks from corporate networks, rigorous monitoring of ICS traffic, and robust backup procedures to mitigate the impact of such disruptive events.