Handala ransomware group lists Innovalve 3TB Data Leak ( $300M ) on its leak site

• Ransomware group: Handala
• Country: Israel
• Sector: Technology
• Announcement date: July 26, 2024

Handala claims to have leaked 3TB of data from Innovalve

The threat actor known as Handala has announced that it has published a massive amount of data allegedly belonging to the technology company Innovalve. According to an announcement made on the group's leak site on July 26, 2024, the group claims to have released 3TB of sensitive information.

The incident was announced on July 26, 2024, with the group claiming the attack occurred on the same day. This type of announcement is characteristic of ransomware groups that utilize leak sites to pressure organizations. In such scenarios, threat actors often employ double extortion tactics, where they not only encrypt an organization's systems but also threaten to release stolen data to maximize leverage during negotiations.

The motivation behind the alleged leak

The Handala group has provided a specific motivation for their actions regarding Innovalve. The group stated that the release of this data was a direct response to the acquisition of the company by Edwards Lifesciences. This suggests that the threat actors had been monitoring the business transaction for some time, and the subsequent data leak was carried out as a reaction to the completion or progress of this deal.

By targeting a company during or following a major acquisition, threat actors can exploit the period of organizational transition. Such periods often involve complex shifts in IT infrastructure and administrative access, which can create temporary vulnerabilities that attackers seek to exploit for political or financial motivations.

Details regarding the leaked information

While the volume of the data is significant, the group has not provided specific details regarding the exact content of the allegedly leaked data. The only information provided by the group is the claim that the data consists of 3TB of sensitive information.

The listing names no specific data types.

About Innovalve

Innovalve is an Israel-based medical device startup that specializes in the development of transcatheter mitral valve replacement (TMVR) technologies. The company has a significant history, having originated from the Sheba Medical Center. Following its development and growth, the company was acquired by Edwards Lifesciences in 2024.

Risk assessment and organizational implications

This leak claim may create significant operational and reputational risks for Innovalve and its parent company through the exposure of corporate data. While the exact content of the data remains unclear, the potential exposure of personal or commercial information could lead to complex compliance issues under the General Data Protection Regulation (GDPR) and other relevant local regulations.

Furthermore, the group behind this claim, Handala, is assessed to have links to Iran and is known to monitor Israel-based entities with political motivations. Because of this political dimension, such actions may potentially facilitate secondary risks for the target organization, such as targeted phishing campaigns or corporate espionage. The significant volume of the claimed data may necessitate a comprehensive and rigorous review of the organization's data security processes.

For organizations operating in the technology and medical device sectors, maintaining robust defensive postures is essential. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring that data encryption is applied both at rest and in transit. Additionally, because threat actors often monitor corporate news and acquisitions to identify targets, organizations should increase their security vigilance during periods of significant corporate restructuring or mergers and acquisitions.