Ben Horin & Alexandrovitz Ltd Listed by handala Ransomware Group

On June 22, 2025, the Israeli firm Ben Horin & Alexandrovitz Ltd appeared on the leak site of the Handala ransomware group after attackers exfiltrated internal files during a ransomware operation.

What's Publicly Reported from Reporting

Public reporting indicates the attackers gained access to the company’s systems and removed sensitive internal documents. The firm, which specializes in psychological operations and has been described as a strategic partner to Israeli intelligence units, was listed on the Handala leak portal hosted on an onion domain. Available reporting describes the data as internal files; the exact volume and complete list of exposed records remain unconfirmed by the company. No specific victim count for individuals whose information appeared in the files has been released.

The incident follows the group’s typical pattern of exfiltrating data before encrypting systems and later publishing samples as leverage for extortion.

Why This Matters for You and Your Family

When a company that handles sensitive contracts or personal data is breached, the information inside those files can include names, contact details, addresses, or other identifiers tied to clients, employees, or partners. If your name, email, phone number, or family details were among the records, attackers or opportunistic criminals can use them to launch further attacks. Credential leaks from such incidents often spread quickly across underground forums, giving thieves the raw material they need to attempt account takeovers on your email, banking, or social media accounts.

Ordinary families are routinely swept up in these breaches when vendors, employers, or service providers are targeted. Once your information is loose, the risk does not disappear after the initial headline fades.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than isolated records. They can link an email address to a full name, home address, phone number, or even notes about family members. Attackers then chain these fragments together with data from previous breaches to build a complete profile. A single exposed work email can lead to discovery of personal accounts, children’s names, or gaming usernames. This identity-chain effect turns one breach into repeated harassment, spear-phishing, or doxxing campaigns that can last for months or years.

Gaming accounts belonging to you or your children are especially vulnerable because the same passwords or email addresses are often reused across entertainment platforms and work systems. A leak from a professional services firm can therefore cascade directly into compromised Roblox, Fortnite, or Steam accounts, exposing chat logs, payment methods, and linked family information.

Handala Group’s Known Track Record

Public reporting attributes the attack to the Handala ransomware group. The group emerged in late 2024 and has focused primarily on organizations it accuses of ties to Israeli intelligence or military activities. Notable prior victims include other Israeli-linked companies and entities the group labels as “occupation” partners. Their standard playbook involves initial access through common vulnerabilities or phishing, followed by exfiltration of internal documents, deployment of ransomware, and publication of stolen samples on their leak site when demands are not met. The group uses ideological messaging in its posts while simultaneously demanding payment to prevent full data release.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate every password you used at Ben Horin & Alexandrovitz Ltd or any related service, replace it with a unique passphrase, and secure those accounts with 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to your children’s gaming accounts and any other linked profiles that could be exploited through the same leaked address or credentials.
• Let remediation specialists handle the follow-up work of submitting takedown requests to data brokers and monitoring platforms where your family’s information has already spread.

The speed with which stolen data moves from a corporate breach to active exploitation leaves little room for delay. Starting with a clear map of your exposure and putting continuous safeguards in place gives you and your family the best chance of staying ahead of the next wave. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.