Handala claims to have stolen shelter locations in Israel

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: June 23, 2025

Handala claims to have compromised Israeli shelter data

The threat actor known as Handala has issued a new announcement on its leak site regarding a recent operation targeting Israel. According to the claim published on June 23, 2025, the group asserts that it has successfully obtained a list containing the precise locations of shelters throughout the country. This announcement marks a significant escalation in the group's public messaging, as they claim the stolen information is now accessible to the public.

In the announcement, the group asserts that because this data is now publicly available, the shelters can no longer provide their intended security function. This claim suggests a focus on undermining the perceived safety and utility of civil defense infrastructure. While the group has made these claims on their leak site, no further details regarding the specific method of entry or the exact volume of data were provided in the announcement.

Details of the alleged data leak

The content of the leak, as described by the threat actor, is centered on the geographical placement of critical safety infrastructure. The group claims to have accessed a list that includes specific details meant to identify where citizens can seek refuge. The information allegedly compromised includes:

• Shelter location data
• Coordinate information

The group's claim specifically highlights that the exact coordinates of these shelters are part of the stolen dataset. By making these coordinates public, the group aims to demonstrate that the security of these locations has been compromised.

Assessment of the threat and potential impact

The alleged leak of this information poses a significant risk to the security of civil defense infrastructure. The public exposure of precise coordinates and locations for shelters could diminish the strategic utility of these facilities and increase physical security risks. When sensitive infrastructure data is moved from a controlled environment to the public domain, the primary purpose of that infrastructure—providing a safe haven—is directly challenged.

Given that the Handala group is assessed to have ties to Iran, these actions may be intended for psychological warfare and destabilization. The group's past activities suggest a pattern of prioritizing disruptive and data-focused attacks against Israel. This specific claim appears to align with that pattern, focusing on information that can be used to create social unrest or undermine public confidence in state-provided safety measures.

Beyond the immediate loss of data privacy, secondary risks for both institutions and the general public could include the targeting of these specific shelters or the triggering of widespread social panic. When information regarding safety and protection is weaponized, the goal is often to create a sense of vulnerability within the population.

Defensive considerations for critical infrastructure

While the specific details of the breach remain unconfirmed, incidents involving the exposure of sensitive location data highlight the need for robust security measures. Organizations managing critical public safety infrastructure often employ several defensive strategies to mitigate such risks. This includes implementing strict access controls to ensure that sensitive geographical data is only available to authorized personnel.

Furthermore, organizations can utilize data masking or encryption for sensitive location-based information to ensure that even if a perimeter is breached, the data remains unreadable. Monitoring for unauthorized access to sensitive databases and maintaining comprehensive audit logs are also standard practices to detect and respond to potential intrusions before data can be exfiltrated to a leak site.