Mor-logistics targeted by Handala group in reported data breach

• Ransomware group: Handala
• Country: Israel
• Sector: Transportation
• Announcement date: June 18, 2025

Handala claims to have breached Mor-logistics

The threat actor known as Handala has claimed responsibility for a cyberattack against the Israel-based organization Mor-logistics. According to an announcement made on the group's leak site on June 18, 2025, the attackers claim to have successfully breached the target's network systems and exfiltrated a significant volume of data.

This type of announcement is a common tactic used by ransomware and extortion groups. These actors often utilize dedicated leak sites to host announcements regarding their successful intrusions. By publicly naming a target and claiming to possess their data, these groups aim to exert maximum psychological and financial pressure on the victim organization. This method is frequently associated with double extortion tactics, where attackers not only encrypt an organization's systems but also threaten to release sensitive information to the public unless a ransom is paid.

Details of the claimed attack

The Handala group announced the attack on June 18, 2025, the same day they claim the intrusion occurred. The group asserts that they gained unauthorized access to the internal network systems of Mor-logistics. According to the group's claims, the total volume of the exfiltrated dataset amounts to 425 GB.

The threat actor has indicated that this breach is merely the beginning of their campaign against the organization. By suggesting that further actions are forthcoming, the group aims to increase the pressure on Mor-logistics to meet their demands. While the group's specific demands have not been disclosed in the public announcement, the intent to escalate the situation remains a central part of their messaging.

Data and information involved

Regarding the specific contents of the stolen information, the group has not provided granular details. However, the claims suggest that the stolen data is highly sensitive in nature.

• Information related to the organization's sensitive cargo operations

The listing does not provide specific details regarding the exact nature of the data types or the specific files involved, other than the claim that the information pertains to the organization's cargo operations. The total size of the claimed data is 425 GB.

Analysis and potential impact

The Handala group is assessed to have ties to Iran and is known for targeting entities based in Israel. This specific breach poses several significant risks to the organization. From an operational standpoint, the breach may compromise the organization's operational security and could lead to substantial disruptions in logistics processes. Given the nature of the transportation sector, such disruptions can have cascading effects on supply chains.

Furthermore, there are legal and security implications to consider. Under Israeli data protection regulations, the organization may face legal consequences resulting from this breach. From a cybersecurity perspective, there is a persistent risk that the exfiltrated data could be utilized in secondary attacks or targeted phishing campaigns against the organization or its partners. Given the group's history of conducting disruptive attacks, the organization's digital infrastructure may remain under significant threat for an extended period.

In general, organizations facing such threats often prioritize incident response and forensic investigation to determine the full scope of the breach. Common defensive steps for organizations in the logistics and transportation sector include implementing strict access controls, enhancing network monitoring, and ensuring robust encryption for sensitive cargo and operational data. Maintaining a strong security posture is essential to mitigate the risks of operational disruption and secondary exploitation of stolen data.