Handala ransomware group lists Targets Locked: The Minds Behind Arrow and David’s Sling Are Revealed on its leak site

• Ransomware group: Handala
• Country: Israel
• Sector: Government & Defense
• Announcement date: December 13, 2025

Handala claims to have exposed identities of defense architects

In a recent announcement posted on December 13, 2025, the group known as Handala claimed to have published the identities of 13 architects involved in Israel's defense systems. The group asserts that by revealing these specific identities, they have successfully compromised the security of the mentioned defense projects. This incident highlights a growing trend where threat actors target specific individuals within critical infrastructure to maximize psychological and operational impact.

According to the group's claim, the individuals targeted are those involved in the development of the 'Arrow' and 'David’s Sling' defense systems. The group has not provided any screenshots to verify the legitimacy of the leak. Furthermore, the group has announced a reward of $30,000 for any individual who can provide additional information regarding these specific individuals, indicating an active interest in gathering more intelligence on the targets.

Details of the alleged data leak

The information released by the group is said to consist of personal identification details belonging to the defense system architects. While the specific volume of the data or the exact file count has not been disclosed, the focus of the leak appears to be highly targeted toward specific personnel. The listing names the following affected data types:

• Personal identification information

In many modern cyberattacks, particularly those involving double extortion, threat actors do not merely encrypt data but also threaten to leak sensitive information to pressure victims. Even when a ransom demand is not explicitly stated in the initial announcement, the exposure of personal details serves as a powerful tool for intimidation and social engineering.

Geopolitical implications and security risks

This incident may pose a targeted threat to personnel working within the defense sector. The public disclosure of identities could significantly increase the risk of both physical and digital attacks against the affected individuals. Such a breach can create secondary security risks for the families and associates of the affected individuals, extending the threat beyond the immediate professional circle.

Given that the Handala group is assessed to have ties to Iran, this action may be driven by geopolitical motivations. When cyberattacks are fueled by geopolitical tensions, the targets are often chosen for their symbolic or strategic importance to national security. This specific exposure could necessitate a comprehensive review of the organization's security protocols and could raise significant national security concerns for the state involved.

Defensive considerations for the defense sector

For organizations operating within the defense and government sectors, incidents of this nature underscore the necessity of robust identity and access management. Protecting the personal information of key personnel is as critical as protecting the technical blueprints of the systems they design. Organizations in this sector often implement rigorous security frameworks to mitigate the risk of targeted reconnaissance and social engineering.

Common defensive steps for organizations facing such threats include implementing strict data loss prevention (DLP) measures, enhancing monitoring of sensitive personnel files, and conducting regular security awareness training to help employees recognize sophisticated phishing or social engineering attempts. Furthermore, as these incidents can lead to physical security risks, a holistic approach that integrates cybersecurity with physical security protocols is essential for protecting high-value targets.