Handala ransomware group lists Braverman Files Unleashed: Every Secret Now Exposed on its leak site

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: December 28, 2025

Handala claims to have leaked data from the Israeli Prime Minister's Office

The threat actor known as Handala has announced a significant data breach targeting the Israeli Prime Minister's Office. In a post published on December 28, 2025, the group claimed to have successfully conducted a cyberattack against the institution. According to the group's announcement, the breach involves sensitive information allegedly belonging to Tzachi Braverman, who serves as the Chief of Staff to the Israeli Prime Minister's Office.

The group claims to have gained unauthorized access to both personal and professional data. Following the alleged breach, Handala stated that they have published various documents on their dedicated leak site to expose what they describe as secrets of the administration.

Details of the claimed data leak

The information released by Handala reportedly contains a variety of sensitive materials. The group claims that the leaked content includes contact directories and communication logs, as well as various photographs. The scope of the data allegedly includes information related to high-level officials and media figures, suggesting a wide reach within the administrative and social circles of the targeted office.

According to the group's claims, the specific types of affected data include:

• Personal contact information
• Private communications
• Photographs
• Administrative documents

The group further claims that the shared content includes lists of media figures and photographs that were purportedly taken during various meetings.

The target organization

The target of this alleged attack is the Prime Minister's Office of Israel. This institution serves as the executive branch of the Israeli government and acts as the administrative center for the Prime Minister. The office is responsible for the coordination of government policies and the management of the daily operations of the Prime Minister.

Risk assessment and organizational implications

This incident may pose a high risk due to the exposure of data belonging to a high-level official within a government and defense-related institution. The exposure of such information could potentially lead to security vulnerabilities for the individuals involved and the institution itself. Furthermore, the leaked information could potentially be utilized for secondary risks, such as identity theft or targeted phishing attacks against the individuals or the organization.

Such a leak might also result in compliance issues regarding privacy standards and data protection regulations in Israel. While the group's specific motives are not detailed, the impact of such a breach in a government sector is significant. Organizations operating in the government and defense sectors often face high-stakes threats where the goal is not just encryption, but the public exposure of sensitive data to cause reputational or political damage.

In general, when organizations face such threats, common defensive steps include implementing strict access controls, enhancing monitoring of administrative accounts, and ensuring robust encryption for both data at rest and data in transit. Organizations also typically focus on employee training to recognize phishing attempts that may follow a data leak. At this time, public information regarding the Handala group remains limited.