Handala ransomware group lists Unveiling the Secrets: Inside the WhatsApp Chats of a Minister on its leak site

• Ransomware group: Handala
• Country: Israel
• Announcement date: January 3, 2026

Handala claims to have accessed private communications of former minister

The threat actor known as Handala has announced a significant data breach involving high-level political communications. On January 3, 2026, the group claimed to have gained access to the private WhatsApp communications of former Minister Ayelet Shaked. This announcement was made via a leak site, marking a targeted operation against a prominent political figure in Israel.

According to the claims made by Handala, this breach is intended to serve as a demonstration of the group's deep and far-reaching access to high-level government officials. The group asserts that their ability to infiltrate such sensitive communication channels highlights their operational capabilities. The information provided by the group includes various screenshots that appear to contain message threads discussing sensitive political and military topics.

Details of the alleged data leak

The content of the leak is alleged to consist of the WhatsApp messaging history belonging to former Minister Ayelet Shaked. The group has not provided information regarding the total size of the data or the specific number of files involved in the breach. Furthermore, there was no mention of a ransom demand or specific details regarding the method of extraction.

The data reportedly involves the following types of information:

• Personal messaging data
• Political communication records

The exposure of these private communications, which include discussions on political and military matters, represents a significant breach of private messaging history.

Assessment of the impact and potential risks

This leak may pose substantial risks to personal privacy and national security due to the exposure of private communications belonging to a high-level political figure. The disclosed content could potentially have negative impacts on the individual's political activities and diplomatic processes. Because the disclosed data may be subject to manipulation, there is a possibility that it could be utilized as a tool for disinformation campaigns.

Given that the group is assessed to have links to Iran, it is considered that this action may be politically motivated and could represent a targeted attempt at reputational damage. Within the framework of Israeli legislation and data protection standards, it may be anticipated that this incident could necessitate a review of security protocols for public officials to prevent similar targeted attacks in the future.

Understanding the threat landscape and defensive measures

This incident highlights the evolving nature of cyber threats where threat actors target specific individuals to achieve political or reputational goals. In many modern cyberattacks, groups utilize double extortion tactics, where they not only encrypt an organization's data but also threaten to leak sensitive information on public forums or leak sites to pressure the victim. This method is particularly effective against high-profile targets where the reputational damage of a leak is often more significant than the operational disruption caused by encryption.

When dealing with targeted attacks on individuals in high-level positions, organizations and government entities often face unique challenges. The use of personal messaging applications for professional or political discussions creates a significant attack surface. If these applications are not secured with advanced protocols, they become prime targets for intelligence gathering and disinformation efforts.

To mitigate such risks, organizations typically focus on several defensive layers. Implementing strict data protection standards and regular security audits is a fundamental step. For public officials, the review of security protocols is essential to ensure that private communications do not become liabilities for national security. Furthermore, organizations must be prepared to counter disinformation campaigns that may arise from manipulated or stolen data. Strengthening identity and access management, enforcing multi-factor authentication, and educating high-profile users on the risks of discussing sensitive topics on non-secure platforms are common defensive strategies used to reduce the likelihood of such breaches.