Passover Wiped Clean: 22TB of Data Gone from 14 Companies Listed by handala Ransomware Group

On April 2, 2026, the Handala Hack ransomware group published a post claiming to have stolen and wiped 22TB of internal data from 14 companies, timing the release to coincide with Passover.

Reported Details from Reporting

Public reporting indicates the group posted the announcement on its leak site, describing the operation as a “large-scale, targeted cyber operation.” The message explicitly linked the timing to the Passover holiday and framed the action in political terms. Available reporting describes the stolen material as internal files exfiltrated during a ransomware attack, though the exact number of people whose records were taken remains unknown. The post listed 14 organizations described as “Zionist companies,” but specific victim names have not been independently verified in open sources. No confirmed timeline of initial access or exfiltration has been released beyond the group’s own claims.

Why This Matters for You and Your Family

When 22 terabytes of corporate data disappear, the information inside often includes employee records, customer details, contracts, and internal communications. If your employer, your bank, your health provider, or a vendor you use is among the 14 companies, your personal information may now sit on a leak site or in the hands of unknown parties. Internal files frequently contain spreadsheets with names, addresses, phone numbers, email accounts, and sometimes Social Security numbers or dates of birth. Once that data leaves a company’s control, it can be sold, traded, or used to launch further attacks against you and your family for years.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at one leak. Stolen corporate files often contain employee directories, vendor lists, and customer databases that link work emails to personal accounts. Those connections let attackers map how your work login, family address, children’s school accounts, and online handles relate to one another. A single exposed work email can lead to password resets on personal services, which then expose gaming accounts, social-media profiles, and family photos. Credential leaks like this one routinely cascade into account takeovers and doxxing chains that reach children’s gaming usernames tied to the same household address.

Handala Hack’s Publicly Known Track Record

Public reporting attributes the Handala Hack group with emerging in late 2024 or early 2025 and focusing on ideologically motivated ransomware and data-wiping operations. The group has claimed responsibility for attacks on organizations it labels as aligned with Israeli interests. Its typical playbook involves gaining initial access, exfiltrating large volumes of data, then publishing announcements that combine technical claims with political statements. After exfiltration the group often threatens to release or delete the data unless its demands—frequently political rather than purely financial—are met. Past incidents show a pattern of timed releases tied to holidays or current events to maximize attention.

What to do

• Run a DoxxScan to map every link between your work emails, personal accounts, phone numbers, and real identity so you can see the exposure chain created by this 22TB leak.
• Rotate every password used at the affected companies anywhere it is reused, and switch on 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become targets when corporate data links back to the same home address.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing your own accounts.

The incident shows that even when companies say they have strong defenses, determined attackers can still remove massive amounts of data and publish it for ideological reasons. Protecting yourself and your family now means treating every breach as the start of a potential identity chain rather than an isolated corporate problem. Start your DoxxScan trial and use its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—to close the gaps before the next leak appears.