handala ransomware group lists Clalit: Israel’s Largest Healthcare Organization Falls to Cyber Resistance on its leak site

• Ransomware group: handala
• Country: Israel
• Sector: Healthcare
• Announcement date: February 25, 2026

The handala group has published a data leak announcement claiming a successful cyber operation against Clalit, the largest healthcare organization in Israel. In the announcement, the group asserts that they have gained unauthorized access to the institution's systems and have successfully obtained sensitive patient data.

The claimed cyber operation

According to the claims made by the handala group, the cyber operation against Clalit took place on February 25, 2026. The group asserts that they were able to penetrate the organization's digital infrastructure, allowing them to access and extract various types of information. To support their claims of interference with the healthcare institution's systems, the group has shared various pieces of visual evidence in their announcement.

The evidence provided by the group includes several screenshots. These images reportedly contain samples of documents that include sensitive information, such as medical files and records belonging to patients. The presence of these screenshots is intended to demonstrate the group's level of access to the organization's internal data environment.

Data allegedly involved in the leak

The announcement by the handala group suggests that a variety of sensitive information has been compromised. Based on the shared screenshots and the group's claims, the following types of data are allegedly included in the leak:

• Patient health records
• Personally identifiable information
• Medical documents

The exposure of such information carries significant implications for the individuals involved, as these data types are highly sensitive and central to a person's private life.

About Clalit

Clalit is the largest healthcare provider and health insurance fund in Israel. The organization operates an extensive and vast network that includes hospitals, clinics, and pharmacies. Through this comprehensive infrastructure, Clalit provides essential healthcare services to millions of people across the country.

Analysis and potential impact

This alleged leak poses significant risks regarding the privacy of patients and the overall protection of sensitive health data. The data that has been purportedly obtained could potentially be utilized by malicious actors for various purposes, such as identity theft or the execution of targeted phishing attacks against individuals.

Given the nature of the group involved, the handala group is assessed to have links to Iran and is known for conducting disruptive activities against Israel. Consequently, this incident is considered to be potentially part of a politically motivated cyber operation. The long-term impacts of such an event may be observed in the organization's operational continuity and the level of trust maintained by its patients.

From a regulatory perspective, it is likely that the organization will face legal processes within the framework of Israeli health regulations and general data protection standards. When organizations in the healthcare sector face such threats, they often focus on defensive measures such as strengthening network segmentation, implementing multi-factor authentication, and conducting regular security audits to protect patient confidentiality.

In the broader context of cyber threats, such incidents often follow the patterns of data extortion, where attackers aim to pressure an organization by threatening to release sensitive information. For healthcare providers, the protection of data integrity and availability is critical to ensuring that medical services remain uninterrupted and that patient safety is not compromised by digital interference.