Handala ransomware group lists Full Access: Jerusalem’s Security Cameras in Handala’s Hands on its leak site

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: March 9, 2026

Handala claims unauthorized access to Jerusalem security systems

The threat actor known as Handala has published a claim alleging unauthorized access to security camera systems in Jerusalem. According to an announcement made on March 9, 2026, the group asserts that it has successfully breached urban and security camera systems within the city. This claim suggests a significant breach of surveillance infrastructure, targeting the security and monitoring capabilities of the region.

The Handala group, which is assessed to have ties to Iran, is known for making claims regarding disruptive attacks targeting Israel. This latest announcement follows a pattern of activities that suggest these cyber operations may be politically motivated. The group has not provided specific details regarding a ransom demand or the total volume of data involved in this specific incident.

Details of the alleged breach and evidence provided

On March 9, 2026, the Handala group announced that it had gained access to urban and security camera systems in Jerusalem. The threat actor claims to have control over video feeds and operational data. To support these assertions, the group provided a proof-of-concept file to demonstrate their access.

The evidence provided by the group consists of screenshots that appear to display camera management interfaces and map-based location data. These visual elements are intended to substantiate the group's claim of having control over the city's surveillance infrastructure. The content of the leak includes:

• Security camera footage
• Operational location data

Potential implications and security considerations

This claim may pose risks to public safety and the integrity of surveillance systems. Unauthorized access to such critical infrastructure could potentially lead to the monitoring of city-wide movements and the exposure of sensitive location information. Such a breach could violate privacy standards mandated by local regulations and undermine the trust in public monitoring systems.

In the broader context of cyber threats, ransomware and data breach groups often utilize various methods to gain access to sensitive networks. While some groups focus on encryption for ransom, others focus on data exfiltration to exert pressure through public exposure. This type of activity highlights the ongoing challenges faced by government and defense sectors in protecting critical urban infrastructure from politically motivated actors.

For organizations managing sensitive surveillance and operational data, several defensive steps are essential. Regular security reviews of all connected systems are necessary to identify vulnerabilities. Implementing robust access controls and monitoring for unauthorized access to management interfaces can help mitigate the risk of such breaches. Furthermore, ensuring that all surveillance hardware and software are updated with the latest security patches is a fundamental requirement for maintaining system integrity and protecting public privacy.

Summary of the incident

The incident involves the following key elements:

• Claimed attack date: 2026-03-09
• Announced on leak site: March 9, 2026
• Targeted sector: Government & Defense
• Nature of announcement: Data breach claim

Relevant authorities may need to review system security and implement measures against potential data breaches to ensure the continued safety and privacy of the city's residents and the integrity of its surveillance networks.