YHD Group targeted by Handala ransomware group

• Ransomware group: Handala
• Country: China
• Sector: Transportation
• Announcement date: June 19, 2025

The threat actor group known as Handala has announced the alleged leak of a significant volume of data belonging to YHD Group, a prominent transportation company based in Israel. According to an announcement posted on the group's leak site, the attackers claim to have successfully breached the organization's systems and exfiltrated a large amount of sensitive information.

The alleged data breach event

On June 19, 2025, the Handala group published a post on their dedicated leak site regarding YHD Group. In this announcement, the group claims to have gained unauthorized access to the company's internal systems. Following this access, the group asserts that they were able to exfiltrate a substantial amount of data from the organization.

The announcement made by the group included links intended for the public to download portions of the alleged stolen data. This method is a common tactic used by ransomware groups operating under a double extortion model. In such scenarios, attackers do not just encrypt an organization's data to demand a ransom for decryption; they also threaten to release the stolen information publicly to increase pressure on the victim. By providing downloadable links, the group attempts to demonstrate the validity of their claims to both the victim and the public.

Details of the claimed stolen data

The Handala group has provided specific metrics regarding the scale of the alleged theft. According to the group's claims, the breach involves a significant amount of information that could impact the company's operations. The specific details provided by the attackers include:

• A total data volume of 116 GB
• A collection of 32,000 documents

While the group has specified the total size and the count of the documents, the announcement does not provide a detailed breakdown of the specific types of data contained within these files. It remains unknown exactly what kind of information is included in the 32,000 documents or the 116 GB of data, as the group did not specify the file formats or the nature of the content.

About YHD Group

YHD Group is a well-established intercity passenger transport company operating across Israel. With a large fleet, the company provides regular services between major cities and remote areas, playing a key role in the country's public transportation sector.

Analysis and potential implications

The Handala group is assessed to have ties to Iran and is known for targeting Israeli entities. This incident may lead to operational disruptions and concerns regarding passenger safety within the transport sector. Furthermore, the company may face legal consequences under Israeli data protection regulations. There is also a significant risk that the leaked data could be exploited by malicious actors for identity theft or targeted phishing campaigns.

Given the group's history of disruptive attacks, it is possible that the organization's digital infrastructure may be subject to further threats. In the transportation sector, such incidents highlight the critical importance of robust cybersecurity measures to protect both operational continuity and passenger information. Organizations in this sector often focus on securing industrial control systems, protecting passenger databases, and ensuring the integrity of scheduling and logistics software to mitigate the impact of such breaches.

General defensive considerations

While the specific details of this breach are still emerging, incidents of this nature often prompt organizations to review their security posture. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments. Protecting against data exfiltration requires monitoring for unusual outbound traffic and ensuring that sensitive data is encrypted both at rest and in transit.