Israel foreign affairs minister Emails Listed by handala Ransomware Group

On September 26, 2024, the Handala ransomware group listed internal files and 60,000 secret emails belonging to Gabi Ashkenazi, Israel’s former Minister of Foreign Affairs and former Chief of General Staff, on its leak site. The posting claims this material represents only a small part of a much larger “data lake” the group holds on him and warns that current Israeli officials and ministries are equally exposed.

Reported Details from the Listing

The Handala leak site entry states that the data was obtained during a ransomware attack and that the 60,000 secret emails now published form only a fraction of the exfiltrated material. The listing does not specify the exact number of total records taken, the precise systems compromised, or the full scope of additional files held back. It does, however, explicitly name Gabi Ashkenazi and frames the breach as part of an ongoing campaign against Israeli government figures, ending with the threat “Be afraid of your shadow!” A download link for the first part of the material is provided on the onion site. The disclosure does not quantify how many other individuals may be affected beyond the named target.

Why This Matters for You and Your Family

Even when the named victim is a high-profile former minister, the breach creates concrete risk for ordinary people. Government email systems frequently contain correspondence with constituents, contractors, family members, and associates whose personal details travel in the same threads. If your name, address, phone number, or email appears in any of those 60,000 secret emails, that information may now be public. Once leaked, such data rarely stays isolated; it is quickly scraped, bundled, and sold on underground markets. The result is an elevated chance that you or members of your family become targets for phishing, identity theft, or harassment campaigns that begin with information pulled from what should have remained internal government communications.

The Doxxing and Identity-Chain Implications

Public email caches like this one accelerate doxxing by giving attackers ready-made links between official identities and private ones. A single email may reveal a personal phone number, spouse’s name, child’s school, or gaming username. Those fragments are then stitched together across other breaches to build a complete profile. Credential leaks of this nature routinely cascade into account takeovers on personal email, social media, and gaming platforms. Children’s gaming accounts are especially vulnerable because the same password or recovery email used for a parent’s government-related correspondence is often reused on Steam, Roblox, or Discord. The Handala listing therefore does not only expose a former minister; it creates fresh entry points for identity thieves and harassers to reach ordinary households whose data happened to touch the compromised environment.

Handala Group’s Known Track Record

Public reporting attributes the Handala name to a ransomware and extortion operation that surfaced in 2024 and focuses primarily on Israeli and Western targets. The group’s typical playbook begins with initial access gained through phishing or exploitation of public-facing services, followed by exfiltration of sensitive files before any encryption is deployed. Extortion follows a double-pressure model: demands for payment are accompanied by public shaming and selective leaks on dedicated leak sites. The September 26, 2024 posting against Gabi Ashkenazi fits this pattern exactly—partial release of material, political messaging, and an explicit threat of further disclosure. Observers note that Handala’s volume of leaks has increased steadily since its emergence, indicating an organized effort to maintain pressure on victims who refuse to pay.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what an attacker could piece together from this breach.
• Rotate any password that appears in the leaked emails or that you have reused across government, personal, or work accounts, and switch to 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in the doxxing chain after credential leaks like this one.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal information appearing on data-broker or extortion sites.

The Handala listing is a reminder that government breaches quickly become everyone’s problem once the emails are dumped. Staying ahead requires more than changing a few passwords; it demands ongoing visibility into how your identity is connected across the internet. Start your DoxxScan trial and put continuous monitoring, identity-chain mapping, and specialist remediation to work for your entire family.