Israel Job Info Ltd targeted by Handala group in alleged data breach

• Ransomware group: Handala
• Country: Israel
• Sector: Professional Services
• Announcement date: June 23, 2025

The threat actor known as Handala has claimed responsibility for a significant data breach targeting Israel Job Info Ltd. According to an announcement made on a leak site on June 23, 2025, the group alleges they have successfully exfiltrated a substantial volume of data from the organization's systems.

Details of the alleged attack

The Handala group announced on June 23, 2025, that it had breached the systems of Israel Job Info Ltd. The group alleges that it has extracted 419 GB of data from the company's database. This announcement marks a significant escalation in the group's activities against the target.

The group's communication regarding the incident includes claims that a portion of the stolen data has already been leaked. Furthermore, the threat actor has issued a demand suggesting that the company's operations should be terminated. While the group has made these claims, no specific ransom demand was mentioned in the announcement.

Data involved in the claim

The alleged data exfiltrated during this incident is extensive and contains various types of sensitive information. The group claims to have obtained a wide range of professional and personal details that could be highly sensitive for the individuals involved. The specific categories of data mentioned in the claim include:

• Names
• Resumes
• Employment contracts
• Communication logs
• Job roles
• Location data
• Areas of expertise

The breadth of this data suggests a comprehensive breach of the organization's internal databases, potentially impacting a large number of individuals associated with the company's professional services.

Risk assessment and implications

This breach may pose secondary risks such as identity theft and targeted phishing attacks for the affected individuals. Because the stolen data includes resumes, employment contracts, and communication logs, the information could be used to craft highly convincing social engineering campaigns. Such attacks often target individuals by leveraging specific details about their professional history and current roles to gain trust.

Given that the company operates in the professional services sector, the exposure of this data could lead to legal consequences under Israeli data protection regulations. Organizations in this sector handle vast amounts of sensitive personal and professional information, making them high-value targets for cybercriminals seeking to exploit data for financial or political purposes.

As the Handala group is assessed to have links to Iran and targets Israeli entities, it is possible that this incident is part of a politically motivated cyber operation. This adds a layer of complexity to the incident, as the motivation may extend beyond simple financial gain to include strategic or political objectives. It is anticipated that operational risks for the company's employees and clients may increase, and the organization may suffer significant reputational damage.

General cybersecurity context

This incident highlights the growing trend of double extortion tactics used by modern threat actors. In these scenarios, attackers do not merely encrypt an organization's data to demand a ransom for decryption; they also exfiltrate sensitive information to use as leverage. By threatening to leak the data publicly, attackers increase the pressure on the victim to comply with their demands, as the reputational and legal damage from a leak can often exceed the cost of the ransom itself.

For organizations operating in professional services, maintaining robust defensive measures is critical. This includes implementing strict access controls, continuous monitoring of network traffic for unusual data movement, and ensuring that all databases are encrypted both at rest and in transit. Furthermore, regular security awareness training for employees can help mitigate the risk of initial access through phishing, which remains a common entry point for such groups.