Israel Police Listed by handala Ransomware Group

On February 9, 2025, the Handala ransomware group publicly listed the Israel Police on its leak site, claiming to have exfiltrated internal files during a ransomware attack on the national law enforcement agency.

What's Publicly Reported from Reporting

Public reporting indicates the Israel Police appeared on the Handala leak portal that day. The group posted a message taunting the agency’s security measures and stating that internal files had been taken. No specific victim count or list of exact data types has been detailed in available screenshots or descriptions from the leak site. The incident is classified as a ransomware event involving both encryption and data exfiltration, consistent with the group’s standard operations. The primary source remains the Handala leak page hosted on an onion domain, as tracked by ransomware.live.

Why This Matters for You and Your Family

When a national police force loses control of internal files, the breach can expose operational details, employee records, informant information, or citizen data that ordinary people like you rely on for safety. If your name, address, phone number, or family members’ details appear in any of those files, the information can quickly move from a dark-web leak site into the hands of identity thieves, stalkers, or fraudsters. Even one exposed government record is enough to trigger months of fraud attempts, loan applications in your name, or unwanted contact. Families feel this directly when children’s school records, medical information, or home addresses surface alongside a parent’s police-related file.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at the first dataset. Criminals combine the newly exposed government files with earlier breaches to build detailed profiles. A work email from the police leak can be matched to personal accounts, social-media handles, and phone numbers already circulating on underground markets. This creates an identity chain that leads directly to you and your family. Credential leaks of this nature frequently cascade into account takeovers, especially on gaming platforms where children use the same email addresses or passwords as their parents. Once a gaming account is hijacked, attackers use it to spread malware, demand ransom from friends, or gather even more personal photos and location data.

Handala Group’s Known Track Record

Public reporting attributes the Handala ransomware group’s emergence to mid-2024. The group has targeted organizations across the Middle East and beyond, with prior claims against government bodies, educational institutions, and private companies. Its typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by lateral movement inside the network, data exfiltration, and deployment of ransomware. After encryption, Handala publishes samples on its leak site and demands payment to prevent full disclosure. The group’s communications often include political or taunting language aimed at victims in law enforcement or government sectors.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password used at the Israel Police or related government services anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours, not months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same addresses or parent credentials.
• Let DoxxScan remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The Israel Police breach is a reminder that even organizations with significant security resources can lose control of sensitive data. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts from the kind of credential-stuffing attacks that follow ransomware incidents like this one.