Freedom Wood Doors Ltd Listed by handala Ransomware Group

On July 6, 2025, Israeli door manufacturer Freedom Wood Doors Ltd appeared on the leak site of the Handala ransomware group after attackers exfiltrated and published 92GB of internal files.

Reported Details of the Breach

Public reporting indicates the company, based in Hod HaSharon, suffered a ransomware attack in which threat actors copied large volumes of sensitive business data before encrypting systems. The dumped material includes full client lists covering private residences, contractors, and several government-linked entities, along with invoices, delivery schedules, internal price quotes, technical specifications, and door schematics for custom projects.

The Handala leak page displays proof-of-concept samples and states that the full 92GB archive is now available for download. No confirmed number of individual customers or employees has been released, but the breadth of client data means anyone who purchased doors from the company in recent years could have personal or business details exposed.

Why This Matters for You and Your Family

When a company that serves private homes is breached, the information that leaks often contains exactly the details needed to locate and target real people. Client lists frequently pair names with addresses, phone numbers, email accounts, and sometimes payment records. If your family bought doors, scheduled an installation, or received a quote, those records may now sit in an archive circulating among criminals.

Once names and addresses are public, they become starting points for phishing campaigns, identity theft attempts, or physical threats. Government-linked clients on the list raise additional concerns about targeted follow-on attacks. For ordinary families, the risk is straightforward: data you never knew was stored at a vendor can suddenly appear in places where criminals shop for victims.

The Doxxing and Identity-Chain Risks

Leaked client records rarely stay isolated. Attackers combine them with other breaches to build identity chains that link your home address to email accounts, phone numbers, online handles, and even children’s usernames. A single invoice that shows your name and delivery address can be cross-referenced with a gaming account using the same email, quickly exposing your family’s full digital footprint.

Credential leaks like this one cascade into account takeovers on unrelated services. Criminals test stolen email-password pairs across banking, shopping, and social platforms. Children’s gaming accounts are especially vulnerable because parents often reuse credentials and because kids may share personal details in chat logs that further enrich a doxxing profile.

Handala Ransomware Group’s Track Record

Public reporting attributes the attack to the Handala ransomware group. The group emerged in late 2024 and has focused primarily on companies in the Middle East and Europe. Notable prior victims include other manufacturing and logistics firms whose client data was similarly published on dedicated leak sites. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of customer databases and internal documents, then extortion demands backed by the threat of public release. Handala posts both proof-of-concept files and full archives when victims do not pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used when ordering from Freedom Wood Doors Ltd or similar vendors, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often form the weakest link in identity chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident shows how data stored by everyday service providers can suddenly surface in ransomware dumps and fuel larger doxxing campaigns. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this 92GB leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.