Benny Gantz Listed by Handala Ransomware Group

On September 23, 2024, the Handala ransomware group listed former Israeli Defense Minister Benny Gantz on its leak site, announcing the publication of 35,000 confidential emails obtained from a ransomware attack on his office. The disclosure indicates that internal files were exfiltrated, with the group claiming to have monitored Gantz for years and releasing only a small sample as a warning.

Primary Disclosure Details

The Handala leak site posting states that the group obtained the material during a ransomware operation targeting Gantz’s office. It explicitly claims the 35,000 confidential emails contain records of “many confidential and destructive meetings.” The listing does not quantify the total volume of data exfiltrated beyond the published sample, nor does it specify the exact systems compromised or the precise date of initial access. Public reporting on the incident attributes the publication directly to Handala’s official extortion portal, hosted on the Tor network.

The disclosure states the data was taken through a ransomware attack that included both encryption and subsequent extortion pressure. No ransom demand figure is publicly listed in the posting itself.

Why This Matters for You and Your Family

When high-profile individuals experience breaches like this, the tactics used often trickle down to ordinary people. Ransomware operators increasingly target offices, email servers, and personal devices that hold sensitive correspondence, financial records, or family information. If your own email or documents may have been exposed in a similar incident, the published material could reveal personal details that put you and your family at risk of identity theft, harassment, or financial fraud.

Confidential emails frequently contain addresses, phone numbers, dates of birth, and references to family members. Once such data leaves a controlled environment, it circulates quickly among cybercriminals who combine it with other stolen records to build complete profiles.

Doxxing and Identity-Chain Implications

The publication of internal emails creates immediate doxxing risks. Attackers can link an email address to social-media handles, phone numbers, and physical addresses, then expand the chain to include family members. A single leaked message that mentions a child’s school, a spouse’s workplace, or a home address can accelerate targeted harassment or identity fraud.

Credential leaks of this nature also cascade into gaming accounts. Children’s usernames and passwords reused from family email addresses become entry points for account takeovers, voice phishing, and further doxxing. The identity chain that begins with one exposed email can rapidly connect disparate online personas back to a single household.

Handala Group’s Known Track Record

Public reporting attributes the emergence of Handala to mid-2024, with the group focusing primarily on Israeli and Western targets using a double-extortion model. The actors combine ransomware deployment with data exfiltration, then publish samples on their leak site to pressure victims into payment. Notable prior victims listed in open-source intelligence include organizations in government-adjacent sectors and private enterprises where sensitive correspondence was allegedly stolen.

Handala’s typical playbook begins with initial access through phishing or exploited remote services, followed by lateral movement to email servers. After exfiltration, the group issues private demands and, upon non-payment, publishes proof files and threatens full data release. The September 23, 2024 listing of Benny Gantz follows this established pattern.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, then use the cleanup to remove exposed data.
• Rotate any password that appears in the 35,000 confidential emails or that was ever used at the compromised office systems, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is detected within hours.
• Cover the entire household with DoxxScan family coverage, which extends protection to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests for any newly surfaced personal information on data-broker and extortion sites.

The Handala listing of Benny Gantz on September 23, 2024 underscores how quickly internal communications can become public ammunition. Protecting yourself means treating every potential exposure as the start of an identity chain rather than an isolated event. Start your DoxxScan trial for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.