Handala ransomware group lists Leaked Documents Reveal Identities of Iran International Staff on its leak site

• Ransomware group: Handala
• Country: United Kingdom
• Announcement date: July 9, 2025

Handala claims to have compromised Iran International data

On July 9, 2025, the threat actor known as Handala published documents and personal information they claim belong to the media organization Iran International. The announcement, made on the group's leak site, alleges that employee identity records and internal communications have been compromised. The group may be attempting to exert pressure on the organization by making these materials public.

The leak involves materials that have been shared via a screenshot. This screenshot contains an image of an identity card allegedly belonging to an employee and text excerpts purported to be internal communications. While the authenticity of the shared data cannot be verified, the exposure of such materials can damage an organization's reputation and compromise the privacy of its employees.

Data types involved in the alleged leak

According to the claims made by the Handala group, the following types of information have been compromised:

• Employee identity information
• Internal communications

The group has not provided information regarding the total size of the data leaked or the specific count of files involved. Furthermore, there was no mention of a ransom demand in the announcement.

About Iran International

Iran International is a London-based international news channel broadcasting in Persian. It is a media organization that focuses on current events and political developments in Iran.

Security implications and organizational risks

This leak may pose personal security risks for the involved staff and could facilitate targeted phishing attacks. When sensitive personal identifiers and internal dialogues are exposed, individuals within the organization become more vulnerable to social engineering tactics. Attackers often use such information to craft highly convincing messages designed to deceive employees into revealing further credentials or installing malware.

As the organization is based in the United Kingdom, the incident may be subject to scrutiny regarding data protection obligations under the UK GDPR. Regulatory bodies often investigate such breaches to ensure that organizations have implemented sufficient technical and organizational measures to protect personal data.

The Handala group is assessed to have ties to Iran and is known for conducting disruptive activities targeting Israel. Such groups often utilize leak sites to host stolen data, a tactic frequently associated with double extortion. In these scenarios, threat actors not only encrypt an organization's systems but also threaten to release sensitive data to maximize leverage during negotiations.

To defend against such threats, organizations in the media and information sectors can implement several defensive steps. Strengthening identity and access management (IAM) can help ensure that only authorized personnel can access sensitive employee files. Additionally, implementing robust encryption for data at rest and in transit can mitigate the impact if a perimeter is breached. Regular security awareness training is also vital to help staff recognize and report potential phishing attempts that may arise following a data exposure event.