Handala claims to have leaked data belonging to Tamir Hayman

• Ransomware group: Handala
• Country: Israel
• Announcement date: March 13, 2026

Handala claims to have leaked data belonging to Tamir Hayman

The threat actor known as Handala has announced an alleged data breach involving Tamir Hayman. According to an announcement made on March 13, 2026, the group claims to have obtained and leaked a significant volume of data belonging to the individual. The group alleges that the information was extracted from a personal mailbox.

Details of the alleged breach

The announcement published by Handala on March 13, 2026, claims that the group has successfully accessed and leaked email correspondences belonging to Tamir Hayman. The group asserts that the data was obtained directly from a personal mailbox. According to the claims made by the threat actor, the leaked information is not merely limited to standard communications but includes highly sensitive materials, such as strategic plans and classified correspondence.

The leak, as described by the group, consists of approximately 50,000 emails. To support their claims, the group has provided screenshots of various correspondence samples alongside the alleged data. While the group has made these claims publicly on their platform, no information was provided regarding a ransom demand or the specific size of the total data set beyond the email count.

Affected data types

• Email correspondence
• Strategic plans

Profile of Tamir Hayman

Tamir Hayman is a retired major general who previously served as the head of the Israeli Military Intelligence Directorate (Aman). In his current capacity, he serves as the executive director of the Institute for National Security Studies (INSS) in Israel.

Security implications and assessment

This alleged leak may pose significant individual and institutional security risks due to the exposure of personal data and sensitive corporate communications. The content of the shared data could impact the reputation of the individuals and institutions involved and may facilitate secondary targeted phishing attacks. Such attacks often use stolen information to craft highly convincing messages to deceive targets.

The Handala group is assessed to have ties to Iran and is known for conducting disruptive activities targeting Israeli entities. This suggests that the leak may be a politically motivated action and that similar attacks could potentially occur in the future. The public availability of these data may lead to speculation regarding national security processes.

In the broader context of cyber threats, ransomware groups often utilize double extortion tactics. In these scenarios, attackers not only encrypt an organization's data but also steal sensitive information to use as leverage, threatening to leak it if a ransom is not paid. This increases the pressure on organizations, as the threat of public exposure can cause lasting reputational damage and regulatory scrutiny.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust identity and access management to prevent unauthorized access to mailboxes, comprehensive encryption for data at rest and in transit, and continuous monitoring for anomalous behavior. Furthermore, regular security awareness training is vital to help individuals recognize and avoid the phishing attempts that often follow a data breach. As these politically motivated attacks continue to emerge, maintaining a proactive and resilient security posture remains essential for protecting sensitive information and institutional integrity.