Operation Octopus: Naftali Bennett Listed by handala Ransomware Group

On December 17, 2025, the Handala ransomware group publicly listed former Israeli Prime Minister Naftali Bennett as its latest victim, claiming to have exfiltrated internal files after breaching his iPhone 13. The announcement, posted on the group’s leak site, includes a taunting message that references Bennett’s past public comments on cybersecurity.

What's Publicly Reported from Reporting

Public reporting indicates the incident falls under an operation the group calls Operation Octopus. The attackers state they obtained internal files from Bennett’s device. No specific volume of records or exact list of stolen data types has been independently verified in available reporting. The group’s post does not disclose a ransom demand deadline or publish any sample files at the time of the initial listing.

The breach was first surfaced through the Handala leak site, which is tracked by ransomware monitoring platforms such as ransomware.live. As of the latest public information, the number of additional individuals or family members affected remains unknown.

Why This Matters for You and Your Family

When high-profile figures experience breaches, the same techniques quickly reach ordinary households. A compromised phone can expose contacts, messages, photos, location history, and passwords stored in password managers or browser caches. Once that information leaks, it rarely stays contained to one person.

Credential leaks from personal devices often cascade into email accounts, banking apps, and social media profiles. For families, the risk extends to shared cloud storage, children’s school accounts, and gaming profiles that use the same email address or phone number. What begins as one stolen phone can quietly expose your entire household’s digital footprint.

The Doxxing and Identity-Chain Implications

Ransomware operators increasingly combine stolen device data with information already circulating on breach repositories. A single exposed email or phone number can be linked to usernames across gaming platforms, social networks, and shopping sites. Attackers then build an “identity chain” that reveals home addresses, family relationships, and daily routines.

Children’s gaming accounts are especially vulnerable because they frequently reuse credentials from parental emails or phones. Once those accounts are hijacked, personal details about your family can be doxxed on public forums or sold privately. Public reporting shows these chains frequently lead to harassment, identity theft, or targeted scams months after the original breach.

Handala Group’s Publicly Known Track Record

Public reporting attributes the Handala ransomware group with emerging in 2024. The group has claimed responsibility for attacks on various organizations and individuals, often focusing on those with public profiles. Its typical playbook involves initial access through phishing or exploited personal devices, followed by exfiltration of sensitive files. The group then uses public leak sites to pressure victims, mixing taunts with threats to publish data if demands are not met.

Available reporting describes Handala’s extortion style as highly personalized, frequently referencing victims’ past statements or professions to maximize embarrassment. Exact success rates and total prior victims are difficult to confirm because many individuals and smaller targets do not publicly acknowledge incidents.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate the password used on the compromised device or service anywhere it is reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same credentials or address.
• Let remediation specialists perform hands-on takedown requests across data brokers and leak sites on your behalf.

The incident shows that no public profile or past cybersecurity commentary protects against determined attackers. Protecting your family now requires ongoing vigilance and tools that actively hunt for leaks before they escalate. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including protection for your own or your children’s gaming accounts that can otherwise become entry points for doxxing. Starting early limits the damage from incidents like this one.