Hebrew University of Jerusalem Listed by handala Ransomware Group

On March 13, 2026, the Handala Hack group listed the Hebrew University of Jerusalem on its leak site, claiming to have exfiltrated internal files from the institution’s servers during a ransomware attack carried out on Quds Day.

What's Publicly Reported from Reporting

Public reporting indicates the university’s domain huji.ac.il was targeted in what the group described as one of the most extensive cyber operations in recent years. The attackers claim they compromised all servers and successfully exfiltrated internal files. As of the listing date, the precise number of affected individuals remains unknown and the specific types of records exposed have not been independently verified. The group published proof of the breach on its dedicated leak site hosted at handala-hack.to.

March 13, 2026 marks the public disclosure on the ransomware leak site. The incident is attributed to the Handala Hack ransomware group, which uses the leak site to pressure victims. No independent confirmation of the full scale of the data theft has been published by the university or third-party investigators at the time of reporting.

Why This Matters for You and Your Family

Even when a university is the named target, ordinary people and their families often end up in the crosshairs. Student records, staff payroll files, alumni contact lists, research participant information, and vendor contracts frequently contain names, addresses, dates of birth, Social Security numbers or local equivalents, email addresses, and phone numbers. Once these details leave institutional control, they can appear in data markets within days.

If your information or that of your children was stored at the Hebrew University — as a current or former student, employee, research subject, or even as a parent linked to a campus account — the exposure creates long-term risk. Credential leaks of this kind routinely cascade into gaming account takeovers, especially for children and teenagers who reuse email addresses or passwords across school systems and online games.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at publishing one file dump. They map relationships between leaked emails, usernames, phone numbers, and real-world identities to enable further extortion or sale of “fullz” packages. A single university breach can therefore seed months of targeted phishing, SIM-swapping attempts, and doxxing campaigns that reach family members who never set foot on campus.

Children’s gaming accounts are particularly vulnerable because many parents link them to a family email or phone number that also appears in educational records. Once an attacker controls one account in the chain, they can pivot to others, turning a distant institutional breach into direct harassment or financial fraud against your household.

Handala Hack Group’s Known Track Record

Public reporting attributes the attacks to the Handala Hack ransomware group. The group emerged in connection with pro-Palestinian hacktivist campaigns and began listing victims on dedicated leak sites in recent years. Notable prior victims have included Israeli-linked organizations and infrastructure targets. Their typical playbook involves initial access through phishing or unpatched vulnerabilities, followed by exfiltration of sensitive files, encryption of systems where possible, and public extortion via leak sites that pressure victims to pay before data is fully released or sold. Exact details of their initial access methods in this incident remain unconfirmed by independent sources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at the Hebrew University or related academic services anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The breach of the Hebrew University of Jerusalem demonstrates how quickly institutional data can become personal risk. Acting promptly on credential hygiene and identity mapping gives you the best chance of limiting damage before opportunistic criminals turn leaked records into targeted attacks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts.