List of Spacecom employees Listed by handala Ransomware Group

On September 28, 2025, the Handala ransomware group published what it claims is an internal employee contact list stolen from Spacecom, a satellite communications company. The files were taken during a ransomware attack in which the attackers exfiltrated internal data before encrypting systems. Anyone whose name, phone number, email address or other contact details appear in the list now faces immediate risks of identity theft, phishing and doxxing.

What's Publicly Reported from Reporting

Public reporting on the Handala leak site, tracked by ransomware.live, shows the group posted a downloadable file described as a Spacecom employee contact list. The data was obtained through a ransomware operation in which the attackers gained access, exfiltrated files, and later published a sample on their leak page. Exact victim count remains unknown, but the list is presented as containing names and contact information of people employed by the Israeli satellite operator. No evidence has surfaced that customer data or satellite control systems were taken, yet the exposed employee records alone create downstream privacy and security problems.

Why This Matters for You and Your Family

When employee contact lists leave corporate networks, the people named in them become easy targets. A phone number or work email published on a ransomware site can be combined with data from previous breaches to build a complete profile. For you or your family members who work at companies like Spacecom, this means higher volumes of spear-phishing emails, smishing texts, and potential voice calls that sound convincingly legitimate. Children’s accounts linked to a parent’s work email or phone can also be pulled into the chain, turning one workplace breach into household-wide exposure.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at the first file. Once an employee’s work email and phone are public, attackers and opportunistic criminals cross-reference them against social-media handles, gaming usernames, and older breach records. This creates an identity chain that links professional details to personal accounts. Credential leaks of this kind frequently cascade into account takeovers on email, banking, and gaming platforms. Gaming accounts belonging to you or your children are especially vulnerable because they often reuse passwords or recovery emails that appear in the same chains.

Handala’s Publicly Known Track Record

Public reporting attributes the Handala ransomware group with operations that began appearing in mid-2024. The group has targeted organizations across multiple sectors, typically gaining initial access through phishing or exploited remote desktop services, exfiltrating data, then deploying ransomware. Their standard playbook involves publishing samples of stolen files on leak sites when victims do not pay the demanded ransom. Notable prior victims include companies in technology, manufacturing, and logistics, according to trackers monitoring ransomware activity. Handala’s extortion style relies on pressure through public exposure rather than prolonged negotiation.

What to do

• Run a DoxxScan to map every link between your work emails, personal handles, phone numbers, and real-world identity so you can see the full exposure chain created by this leak.
• Rotate the password used at Spacecom anywhere it is reused, enable 2FA with an authenticator app instead of SMS, and review account recovery options on every service tied to those credentials.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become targets when parent credentials appear in the same identity chains.
• Let remediation specialists handle takedown requests for any personal information already posted on data-broker and people-search sites that attackers could combine with the Spacecom list.

The Spacecom incident is a reminder that workplace data leaks quickly become personal problems. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before the next wave of phishing or doxxing begins.