099 ISP Listed by handala Ransomware Group

On June 14, 2025, the ransomware group Handala listed 099 Primo Telecomunications LTD, an Israeli internet service provider known as 099 ISP, on its leak site after breaching the company’s internal infrastructure and exfiltrating files. The attackers sent more than 150,000 warning emails through the ISP’s own mail servers and publicly claimed they could have disrupted service but chose to demonstrate access instead.

What's Publicly Reported from Reporting

Public reporting indicates that Handala gained access to 099 ISP’s internal systems and removed sensitive files. The group then used the ISP’s official email infrastructure to dispatch the large volume of warning messages. No confirmed customer count has been released, and the precise number of people whose records were taken remains unknown. The data exposed consists of internal files; available reporting does not detail specific categories such as names, addresses, or payment information. The incident was first documented on the Handala leak site hosted on an onion domain and mirrored by ransomware tracking services.

Why This Matters for You and Your Family

When an ISP is breached, the consequences reach every household that relies on its internet service. Internal files often contain billing records, support tickets, router details, and account notes that can be stitched together with other leaks to build a profile of your daily life. For families, this means your home address, phone numbers tied to the account, and potentially the names of every person on the plan become building blocks for further targeting. Children’s devices connected to the same household network can also be exposed through linked gaming or streaming logins, turning one corporate breach into a household privacy problem.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at the first dataset. A single ISP breach can supply the missing address or phone number that links your email address, username, and gaming handle into a complete identity chain. Once attackers map those connections, they can move from doxxing to account takeovers on services where the same password or recovery details were reused. Credential leaks like this one frequently cascade into children’s gaming accounts, where loose privacy settings expose real names and locations. The result is a road map that lets malicious actors harass, impersonate, or extort family members across multiple platforms.

Handala Group’s Known Track Record

Public reporting attributes the attack to the Handala ransomware group. The group emerged in late 2024 and has focused primarily on Israeli organizations. Notable prior victims include other companies in the technology and telecommunications sectors. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents, and then extortion through both direct email campaigns and public leak-site pressure. The group often claims it could have caused immediate operational damage but prefers to prove access by sending mass notifications from the victim’s own systems.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate the password you used for any 099 ISP account or service and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces it is caught within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address and credentials.
• Let DoxxScan remediation specialists handle takedown requests and broker removals for you while you focus on securing your own devices and accounts.

The 099 ISP breach shows how quickly corporate infrastructure problems become personal privacy emergencies. One leak can quietly feed the next, especially when gaming accounts and family devices share the same underlying details. Starting with a DoxxScan gives you a clear map of those connections and brings in specialists for hands-on remediation across data brokers and exposed records. By treating every breach as part of a larger identity chain, you and your family can stay ahead of the next stage of targeting.