Handala ransomware group lists List of Spacecom employees on its leak site

• Ransomware group: Handala
• Country: Israel
• Sector: Technology
• Announcement date: September 28, 2025

Handala claims to have stolen Spacecom employee contact information

The threat actor known as Handala has published an announcement on its leak site claiming to possess contact information for Spacecom employees. This announcement, posted on September 28, 2025, marks a recent development in the group's ongoing activities targeting specific entities.

Details of the alleged attack

According to the announcement published by the Handala group, the threat actor claims to have obtained a list of employees from Spacecom. The group has used this platform not only to claim possession of the data but also to criticize the communication strategies employed by the company. The threat actor alleges that they have gained direct access to the personal contact details of the staff members.

The announcement indicates that the purported data is currently available for download on the group's leak site. While the group has made these claims, the specific details regarding the method of entry or the exact nature of the breach have not been provided in the public announcement. The group's history suggests a focus on specific regional targets, and this incident follows that pattern.

Data involved in the leak

The announcement claims to contain a list of contact information belonging to Spacecom employees. The specific types of data allegedly compromised include:

• Employee contact information

No information was provided regarding the total size of the data or the specific number of files involved in this alleged breach.

About Spacecom

Spacecom is an Israeli company that provides satellite-based communication services. It offers broadcasting, data, and telecommunication solutions globally through its AMOS satellite fleet.

Analysis and potential impact

This alleged data leak may increase the risk of phishing and social engineering attacks targeting the company's employees. The exposure of employee contact details could facilitate secondary attack attempts against corporate networks. When personal contact information is leaked, attackers often use it to craft highly convincing messages designed to trick employees into revealing credentials or installing malware.

Given the Handala group's history of Israel-focused activities, it is possible that this incident is part of a politically motivated cyber operation. The group's past activities suggest that it may possess the capability for disruptive attacks, which adds a layer of risk to the organization's security posture.

In such scenarios, organizations may need to inform their employees and review their security measures in accordance with relevant data protection regulations. Common defensive steps for organizations facing such risks include implementing multi-factor authentication, conducting regular security awareness training, and enhancing monitoring for unusual communication patterns. The exposure of employee details necessitates a proactive approach to prevent these leaked details from being used as a gateway for further network infiltration.