Leaked Documents Reveal Identities of Iran International Staff Listed by handala Ransomware Group

On July 9, 2025, the Handala ransomware group published internal documents from Iran International, exposing the identities and personal details of staff members, including journalist Arghavan Shams, who promotes LGBTQ-related issues inside Iran.

What's Publicly Reported from Reporting

Public reporting indicates the files were exfiltrated during a ransomware attack on the network. The leaked material includes documents that name specific employees and appear to reveal personal information that had been kept private. The Handala group posted the material on its leak site, with messages directly addressing individuals such as Nadia Tariqi and referencing their roles in editorial decisions at Iran International. Available reporting describes the exposed data as internal files rather than a full customer database, but the precise number of staff affected remains unknown. The incident follows the group’s typical pattern of stealing data before demanding payment.

Why This Matters for You and Your Family

When an organization you interact with, donate to, or follow for news suffers a breach, your own information can quickly become entangled. Names, editorial roles, and personal details that surface in these leaks can be cross-referenced with social-media accounts, phone numbers, or family addresses already visible online. For ordinary people, this means one relative’s professional exposure can place an entire household at risk of harassment, identity theft, or physical threats. Even if you are not a journalist, the same mechanics apply to any data leak that touches your email, phone, or workplace systems. Once information escapes, it rarely stays contained.

The Doxxing and Identity-Chain Implications

Leaked internal files often serve as the first link in a longer doxxing chain. Attackers combine newly exposed names and roles with existing public records, gaming usernames, or reused passwords to build a complete profile. This process can reveal home addresses, family members’ names, and even children’s online accounts. Credential leaks like this one frequently cascade into account takeovers across unrelated services. Gaming platforms are especially vulnerable because many families reuse passwords or security questions that appear in professional breaches. The result is a map that connects your work identity to your personal and family digital footprint.

Handala Group’s Known Track Record

Public reporting attributes the attack to the Handala ransomware group. The group emerged in recent years and has targeted media organizations and entities linked to Iran. Its publicly known playbook involves initial access through common intrusion methods, followed by exfiltration of internal documents, and then public shaming on leak sites when ransom demands are not met. Notable prior victims include other news outlets and organizations whose staff faced targeted pressure after leaks. The group’s messages often personalize the extortion by naming individuals and referencing their specific roles.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate the password used at Iran International or any related service anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that can chain back to the same address or credentials.
• Let remediation specialists perform takedown requests across data brokers and leak sites on your behalf while you focus on securing accounts.

The speed with which leaked documents spread online leaves little room for delay. Acting quickly on exposed credentials and hidden identity links can prevent a single breach from becoming a prolonged campaign against you or your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: handala leak site (via ransomware.live)