Avraham Hayyim ( Mehrdad Rahimi ) – Mossad Agent Listed by Handala Ransomware Group

On January 18, 2026, the Handala ransomware group published internal files stolen from an individual identified as Avraham Hayyim, also known as Mehrdad Rahimi, described in the leak as a guiding officer for Iranian agents on Mossad’s Iran Desk. The posting on the group’s leak site included exfiltrated documents that appear to expose personal and operational details, placing anyone whose information appears in the files at risk of identity theft, targeted harassment, or further extortion.

What Public Reporting Shows

Public reporting indicates the files were taken during a ransomware attack and later published on the Handala leak site hosted at handala-hack.to. The data includes internal documents that reference both the real name and alias of the listed individual along with details of alleged activities tied to Mossad operations inside Iran. Available reporting describes the exposure as part of a typical ransomware double-extortion tactic in which stolen data is threatened with release unless payment is made. No confirmed victim count has been published, and the precise volume of records released remains unclear from open sources.

January 18, 2026 marks the public appearance of the material. The breach involved internal files exfiltrated rather than a mass consumer database, yet the personal nature of the documents means ordinary individuals whose names, addresses, or contact details surface in follow-on leaks can face immediate risks.

Why This Matters for You and Your Family

When operational or personal files from any organization or individual are dumped online, the information rarely stays contained. Names, email addresses, phone numbers, or linked accounts can be scraped within hours and sold on underground forums. For you and your family this means yesterday’s obscure breach can become tomorrow’s wave of phishing texts, spoofed calls, or attempts to access your bank, email, or social-media accounts.