Avraham Hayyim ( Mehrdad Rahimi ) – Mossad Agent Listed by handala Ransomware Group

On January 18, 2026, the Handala ransomware group published internal files stolen from an individual identified as Avraham Hayyim, also known as Mehrdad Rahimi, described in the leak as a guiding officer for Iranian agents on Mossad’s Iran Desk. The posting on the group’s leak site included exfiltrated documents that appear to expose personal and operational details, placing anyone whose information appears in the files at risk of identity theft, targeted harassment, or further extortion.

What's Publicly Reported from Reporting

Public reporting indicates the files were taken during a ransomware attack and later published on the Handala leak site hosted at handala-hack.to. The data includes internal documents that reference both the real name and alias of the listed individual along with details of alleged activities tied to Mossad operations inside Iran. Available reporting describes the exposure as part of a typical ransomware double-extortion tactic in which stolen data is threatened with release unless payment is made. No confirmed victim count has been published, and the precise volume of records released remains unclear from open sources.

January 18, 2026 marks the public appearance of the material. The breach involved internal files exfiltrated rather than a mass consumer database, yet the personal nature of the documents means ordinary individuals whose names, addresses, or contact details surface in follow-on leaks can face immediate risks.

Why This Matters for You and Your Family

When operational or personal files from any organization or individual are dumped online, the information rarely stays contained. Names, email addresses, phone numbers, or linked accounts can be scraped within hours and sold on underground forums. For you and your family this means yesterday’s obscure breach can become tomorrow’s wave of phishing texts, spoofed calls, or attempts to access your bank, email, or social-media accounts.

Children’s gaming usernames and linked emails are especially vulnerable. Credential leaks like this one often cascade into account takeovers on platforms such as Roblox, Fortnite, or Discord, where stolen logins give attackers entry points to harvest further personal data or harass family members directly.

The Doxxing and Identity-Chain Implications

Once a single record appears, attackers routinely map every connected handle, phone number, email address, and family member. This identity-chain process turns one leaked name into a complete profile that can be used for doxxing, swatting, or sustained extortion. Public reporting on similar incidents shows that even limited personal details frequently lead to broader exposure across dozens of sites within days.

Credential leaks cascade into gaming-account takeovers and doxxing chains that can affect every member of a household. What begins as an obscure ransomware posting can quickly surface on multiple breach repositories and forum marketplaces, making proactive detection essential.

Handala Group’s Publicly Known Track Record

Public reporting attributes the Handala ransomware group with operations that emerged in recent years targeting both private individuals and organizations perceived as tied to geopolitical tensions. Notable prior victims include entities linked to Middle Eastern and Iranian interests, though exact timelines and full victim lists remain limited in open sources. The group’s typical playbook involves initial access through common vectors such as phishing or unpatched remote desktop services, followed by exfiltration of sensitive files and publication on a dedicated leak site when ransom demands are unmet. Their extortion style relies on public shaming and selective release of documents to pressure victims.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what can be taken down immediately.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Rotate any password used on systems or services mentioned in the leaked files wherever that password has been reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or parent emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or forum moderators.

The incident underscores a simple reality: data once stolen will keep spreading unless actively stopped. A single ransomware posting can ignite months of follow-on abuse for anyone whose details surface. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire family, including children’s gaming accounts. Starting protective measures now limits the damage from both this leak and the ones that will inevitably follow.