Israel’s fuel supply system Listed by handala Ransomware Group

On June 14, 2025, the Handala ransomware group listed Israel’s fuel supplier Delek and its subsidiary Delkol on its leak site, claiming to have stolen more than 2 terabytes of internal files from the companies that operate a significant portion of the country’s fuel distribution network.

Reported Details of the Incident

Public reporting indicates the attackers gained access to Delek and Delkol systems and exfiltrated large volumes of internal documents. The data includes operational files that could reveal fuel station layouts, supply chain logistics, and potentially sensitive corporate information. The Handala leak page, hosted on an onion site and tracked by ransomware.live, displayed samples and announced the breach with a countdown timer typical of extortion campaigns. No exact number of individuals whose personal data may have been exposed has been confirmed, yet anyone whose records passed through these corporate systems could be affected. Available reporting describes the incident as a classic ransomware double-extortion play: encrypt systems where possible and threaten to publish stolen data unless a ransom is paid.

Why This Matters for You and Your Family

When fuel suppliers are hit, the consequences reach far beyond corporate boardrooms. Delek and Delkol manage networks of gas stations, logistics fleets, and customer loyalty programs that store names, addresses, payment details, and vehicle information. If any of those records were included in the 2 terabytes of exfiltrated data, your family’s everyday transactions could become ammunition for identity thieves. A single leaked loyalty card linked to your home address can give criminals the starting point they need to build a full profile. Children’s after-school sports schedules, family travel plans, and even medical appointment reminders sometimes sit inside corporate calendars or shared drives; once those appear on dark-web forums, the risk of harassment or targeted scams increases sharply.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Criminals scan stolen spreadsheets for email addresses, phone numbers, and employee names, then cross-reference them against breached gaming platforms, social media, and data-broker sites. A fuel-company employee’s work email tied to a child’s Roblox or Fortnite account can create a direct path to doxxing. Public reporting shows these chains often lead to swatting, blackmail, or account takeovers that affect the entire household. Credential leaks like this one cascade quickly: a reused password from a corporate portal ends up on a child’s gaming login, exposing the whole family to harassment and financial fraud.

Handala Group’s Known Track Record

Public reporting attributes the Handala ransomware group with emerging in late 2024. The group has targeted organizations in the Middle East and Europe, focusing on critical infrastructure and energy-related companies. Its publicly known victims include other industrial and logistics firms. The typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of sensitive files. Handala then deploys encryption where possible and posts samples on its leak site with a short payment deadline, threatening full data release or sale to third parties. Observers note the group’s willingness to publicize operational details that could disrupt physical services such as fuel distribution.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, gaming handles, and real-world identity so you can break the chains attackers rely on.
• Rotate any password you ever used at Delek, Delkol, or their partner portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours, not months.
• Cover the household with DoxxScan family protection that includes children’s gaming accounts, which often become the weakest link in doxxing chains after credential leaks like this one.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal records while you focus on securing your own devices and accounts.

The incident shows how quickly corporate breaches turn into personal exposure for ordinary families who never interacted directly with the victim company. Taking concrete steps now limits the damage and reduces the chance that your information becomes part of the next leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and full household coverage that protects both adult accounts and children’s gaming profiles. Start your DoxxScan trial today to regain control of your digital footprint.