Ivri, Kerner & Co targeted in data leak by Handala group

• Ransomware group: Handala
• Country: Israel
• Sector: Professional Services
• Announcement date: July 2, 2025

The threat actor known as Handala has announced a significant data breach involving the Israeli law firm Ivri, Kerner & Co. According to a leak site announcement published on July 2, 2025, the group claims to have exfiltrated 345 GB of data belonging to the organization. This announcement marks a targeted operation against a professional services firm, with the group asserting that the stolen information has been made available for public download through their platform.

The details of the claimed attack

The Handala group published its leak announcement on July 2, 2025, claiming to have successfully compromised the systems of Ivri, Kerner & Co. The group asserts that they have gained unauthorized access to various sensitive internal files and documents. This type of activity is common in modern cyberattacks, where threat actors move beyond simple encryption to a method known as double extortion. In double extortion scenarios, attackers not only lock an organization's data but also threaten to release sensitive information publicly to increase pressure on the victim.

The group claims that the breach was successful on July 2, 2025, the same day the announcement was made. While the specific method of initial entry was not disclosed in the announcement, the group maintains that they have successfully accessed a vast repository of information. The data, totaling 345 GB, is reportedly being hosted on the group's own platform, where it can be accessed by the public, representing a direct violation of the firm's data privacy and security protocols.

Data allegedly involved in the leak

The announcement from Handala specifies that the leaked information includes a variety of sensitive materials. The group claims to have accessed several categories of confidential information that are critical to the firm's operations and its relationship with its clients. The specific types of data mentioned in the claim include:

• Client communications
• Legal documents
• Internal corporate files

The inclusion of such diverse data types suggests a deep level of access into the firm's digital environment. The claim that confidential archives were also part of the leak highlights the potential breadth of the exposure, potentially impacting a wide range of legal and corporate matters handled by the firm.

Organization profile

Ivri, Kerner & Co. is a law firm based in Israel. The company operates in the fields of corporate law, commercial law, and related professional services.

Potential impact and organizational risks

This breach may pose significant risks regarding client confidentiality and attorney-client privilege. Because the firm operates within the legal sector, the exposure of legal documents and client communications is particularly sensitive. Furthermore, as the firm is based in Israel, the leaked data may be subject to local data protection regulations, which could lead to complex legal and regulatory scrutiny for the organization.

There is a possibility that clients could be exposed to identity theft or targeted phishing attacks due to the nature of the leaked files. When sensitive personal or corporate information is leaked, attackers often use it to craft highly convincing social engineering campaigns. Additionally, given that the Handala group is assessed to have ties to Iran and operates with ideological motivations, this action may be intended to cause disruption rather than purely financial gain. Consequently, the firm could face significant reputational damage and potential legal consequences resulting from the exposure of their archives.

For organizations in the professional services sector, such incidents underscore the necessity of robust defensive measures. Common defensive steps include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security awareness training for staff. Furthermore, maintaining offline, encrypted backups and implementing comprehensive monitoring to detect unauthorized data exfiltration are essential components of a modern cybersecurity posture. As threat actors increasingly target high-value professional services to exploit the sensitive nature of their data, continuous vigilance and adherence to data protection frameworks remain critical.