Iran Internation WhatsApp and Internal Access Listed by handala Ransomware Group

On July 9, 2025, the Handala ransomware group listed internal files and access credentials from Iran International on its leak site, claiming that the news outlet’s WhatsApp systems and internal infrastructure had been compromised.

Reported Details of the Breach

Public reporting indicates the attackers gained access to both WhatsApp accounts and broader internal systems. The group claims the intrusion lasted 31 months, during which they exfiltrated internal files. The announcement on the Handala leak site included a taunting message suggesting the victim had only discovered part of the compromise. No exact number of affected individuals has been confirmed, but the breach involves sensitive internal documents and communication channels used by the organization’s staff.

Available reporting describes the data as internal files rather than a simple list of customer records. The ransomware operators published proof of access on their onion site, which is tracked by ransomware.live.

Why This Matters for You and Your Family

When a news organization’s internal messaging and files are stolen, the ripple effects reach ordinary people. Journalists, sources, and their families can face harassment, identity theft, or physical risk if contact details, correspondence, or personal information appear in the wrong hands. If you or anyone in your household has interacted with Iran International — as a viewer, contributor, or through family overseas — your information could be part of the chain.

Credential leaks like this one often spread far beyond the initial target. Passwords or session tokens reused across personal accounts put your email, banking, and social media at risk. Children’s gaming accounts linked to family email addresses are especially vulnerable because gaming platforms frequently become entry points for doxxing and further extortion.

The Doxxing and Identity-Chain Risks

Ransomware groups increasingly map relationships between work accounts, personal messaging apps, and home internet connections. A single exposed WhatsApp account can reveal phone numbers, linked email addresses, and chat histories that attackers use to build a complete picture of your life. Once they connect your professional identity to your home address or children’s online handles, the risk escalates from data theft to targeted harassment or financial fraud.

These identity chains are difficult to untangle manually. One leaked credential can unlock multiple services, turning a workplace breach into a household crisis that affects every family member.

Handala Group’s Known Track Record

Public reporting attributes the Handala ransomware group with operations that emerged in recent years and focus on media outlets and organizations perceived as politically sensitive. The group’s typical playbook involves long-term access — sometimes remaining undetected for months or years — followed by exfiltration of internal documents. They then use public leak sites to pressure victims, combining data exposure with mocking messages designed to maximize embarrassment and fear. Notable prior victims have included other news and advocacy organizations, though exact details remain limited in open sources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see the full exposure chain created by this claimed breach.
• Rotate any password used at Iran International or its internal systems anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next credential leak that touches your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials exposed in incidents like this.
• Let DoxxScan remediation specialists handle takedown requests and broker removals for you while you focus on securing day-to-day accounts.

The speed with which ransomware operators move from initial access to public shaming leaves little room for delay. Taking concrete steps now can break the identity chain before it reaches your family. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with coverage that includes your household and children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.