Haor Heavy Transport Listed by handala Ransomware Group

On June 19, 2025, Haor Heavy Transport appeared on the leak site of the handala ransomware group. The Israeli overland transport company had its internal files exfiltrated following a ransomware attack. While the exact number of people whose information was taken remains unknown, anyone whose personal or business records passed through Haor’s systems could now be exposed.

What's Publicly Reported from Reporting

Public reporting indicates that handala posted proof of the breach on its leak site, showing samples of stolen internal documents. The data includes files that would normally contain customer details, shipment records, employee information, and operational logs. No specific count of affected records has been released, and Haor has not issued a public statement detailing the scope. The incident follows the group’s typical pattern of exfiltrating data before encrypting systems and then threatening to publish it unless a ransom is paid.

Why This Matters for You and Your Family

When a logistics company like Haor is breached, the information exposed often includes names, addresses, phone numbers, email accounts, and sometimes government identification numbers tied to shipments or employment. Internal files from transport firms frequently hold copies of passports, driver’s licenses, or family contact details submitted for customs or insurance purposes. If your family has used an Israeli transport service for household goods, vehicle shipping, or business logistics in the past few years, your information may be among the stolen records. Once leaked, this data rarely stays contained. It spreads across underground forums and can be combined with other breaches to build a complete profile of your household.

The Doxxing and Identity-Chain Implications

Stolen logistics records create dangerous bridges between your real identity and online handles. A single address or phone number listed in a shipment manifest can link your social-media accounts, children’s gaming usernames, and family email addresses. Attackers follow these chains to locate you, impersonate you, or harass your family. Credential leaks of this kind frequently cascade into account takeovers on gaming platforms, email services, and banking apps. Public reporting shows that children’s gaming accounts are especially vulnerable because parents often reuse passwords or security questions that appear in transport or employment files. The result is not just identity theft but sustained doxxing that can affect every member of the household.

Handala Group’s Known Track Record

Public reporting attributes the attack to the handala ransomware group. The group emerged in late 2024 and has focused primarily on organizations connected to Israel. Notable prior victims include other Israeli companies in logistics, technology, and manufacturing sectors. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files over several days. They then deploy ransomware to encrypt systems and publish samples on their leak site to pressure victims. Extortion demands are usually accompanied by countdown timers and threats to release full datasets if payment is not made. Available reporting describes handala as opportunistic within its targeted geographic focus rather than highly sophisticated.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours rather than months.
• Rotate every password you used at Haor Heavy Transport or any related logistics provider, then enable two-factor authentication through an authenticator app on all accounts where those credentials were reused.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same leaked addresses and contact details.
• Let remediation specialists manage takedown requests for any exposed personal records appearing on data broker sites or underground forums.

The handala breach of Haor Heavy Transport is a reminder that logistics companies hold some of the most connective data about ordinary families. Protecting yourself means acting before the next link in the identity chain is sold. Start your DoxxScan trial today and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—work on your behalf. DoxxScan by GalaxyWarden is built exactly for incidents like this one.