Raz Zimmt’s Chats Leaked to the World Listed by Handala Ransomware Group

On April 6, 2026, the Handala ransomware group published internal files and private chats belonging to Raz Zimmt, Head of the Iran Desk at the Israeli National Security Institute. The leak includes WhatsApp conversations and X (formerly Twitter) messages that the group claims were taken during a ransomware attack on the institute.

Reported Details of the Incident

Public reporting indicates the files appeared on the Handala leak site hosted at handala-hack.tw. The group states it had repeatedly warned Zimmt to leave his position and that the publication serves as retaliation for ignoring those demands. Available reporting describes the exposed material as internal documents and direct messages from WhatsApp and X accounts. The exact number of affected individuals remains unknown, though the breach centers on one high-profile staff member at an Israeli government-affiliated research body. No confirmed timeline for initial access or data exfiltration has been publicly released beyond the April 6 publication date.

Why This Matters for You and Your Family

When organizations that handle sensitive national-security or policy work are breached, ordinary people feel the ripple effects. Your personal data can appear in the same underground markets that threat actors use to pressure public figures. Credential leaks from one incident frequently cascade into takeovers of personal email, social media, and financial accounts. For families, a single exposed phone number or reused password can link a parent’s professional life to children’s online identities, creating long-term privacy and safety risks that last years after the initial breach.

The Doxxing and Identity-Chain Risks

Private chats and internal files often contain metadata, phone numbers, email addresses, and personal details that allow attackers to map relationships between online handles and real-world identities. Once these links are established, subsequent doxxing attacks become easier and more damaging. Public reporting on similar incidents shows that published messages are frequently scraped, reposted, and combined with data from other breaches to build detailed profiles. Gaming accounts belonging to children are especially vulnerable because they often share the same household email or phone number used in professional communications, turning one institutional breach into a chain that can expose an entire family.