Israel Job Info Ltd Listed by handala Ransomware Group

On June 23, 2025, the ransomware group Handala listed Israel Job Info Ltd on its leak site after exfiltrating 419 gigabytes of internal files. The company, a major player in Israeli employment services, had names, resumes, contracts, and internal communications stolen in the attack. Anyone who submitted personal information through the firm’s recruitment platforms may now have their data exposed.

What's Publicly Reported from Reporting

Public reporting indicates the breach occurred through a ransomware operation. Handala claims it accessed the company’s systems via an unidentified backdoor and quietly removed the data before encrypting or disrupting operations. The leak site lists the incident with a sample of the stolen material, including what appear to be employee records, candidate resumes, and business correspondence.

419 gigabytes of data were taken. No exact victim count has been released, but the nature of an employment agency’s database suggests thousands of individuals could be affected. The exposed information includes full names, contact details, employment histories, identification numbers, and internal messages. As of the publication date on the leak site, the company had not issued a public statement confirming the incident.

Why This Matters for You and Your Family

If you or anyone in your household has applied for work through Israeli recruitment platforms, your personal documents could be in the hands of criminals. Resumes often contain home addresses, phone numbers, email accounts, dates of birth, and sometimes national ID numbers. Once this information leaves a legitimate company’s control, it can be sold, traded, or used to impersonate you.

Names, resumes, contracts, and communications are particularly valuable because they provide a ready-made profile for identity thieves. Criminals can combine these details with information from other breaches to build convincing profiles. For families, the risk extends beyond the primary job seeker. Spouses, partners, or children listed as emergency contacts or co-applicants may also find their information exposed.

The Doxxing and Identity-Chain Implications

Stolen employment records rarely stay isolated. A single resume can link your professional email to personal accounts, phone numbers to social media handles, and work history to family names and addresses. Attackers follow these connections to create detailed identity chains that lead to doxxing, targeted phishing, or account takeovers. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse email addresses or passwords from school or job applications.

Credential leaks like this one cascade into gaming platforms, chat services, and family-shared accounts. A criminal who obtains your resume may discover your child’s username on a popular game, then use the parent’s breached email to reset passwords and seize control. This chain can quickly move from financial fraud to public harassment when personal details are posted on forums or social media.

Handala Group’s Known Track Record

Public reporting attributes the attack to the Handala ransomware group. The group emerged in late 2024 and has focused primarily on organizations tied to Israeli government or commercial interests. Notable prior victims include other companies described by the group as supporting what it calls “the regime.” Their typical playbook involves initial access through phishing or unpatched remote desktop services, followed by quiet data exfiltration over days or weeks. Once they have the material, they publish samples on their leak site and demand payment to prevent full release. Extortion messages frequently use political language alongside standard ransomware pressure tactics.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used on Israel Job Info Ltd or related recruitment sites, then enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same breached emails and addresses.
• Let DoxxScan remediation specialists handle the time-consuming work of sending takedown requests to data brokers and suspicious sites holding your information.

The incident shows how quickly employment data can fuel larger identity crimes. Taking concrete steps now limits how far criminals can travel along the chains created by this and future breaches. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.