Raz Zimmt’s Chats Leaked to the World Listed by handala Ransomware Group

On April 6, 2026, the Handala ransomware group published internal files and private chats belonging to Raz Zimmt, Head of the Iran Desk at the Israeli National Security Institute. The leak includes WhatsApp conversations and X (formerly Twitter) messages that the group claims were taken during a ransomware attack on the institute.

Reported Details of the Incident

Public reporting indicates the files appeared on the Handala leak site hosted at handala-hack.tw. The group states it had repeatedly warned Zimmt to leave his position and that the publication serves as retaliation for ignoring those demands. Available reporting describes the exposed material as internal documents and direct messages from WhatsApp and X accounts. The exact number of affected individuals remains unknown, though the breach centers on one high-profile staff member at an Israeli government-affiliated research body. No confirmed timeline for initial access or data exfiltration has been publicly released beyond the April 6 publication date.

Why This Matters for You and Your Family

When organizations that handle sensitive national-security or policy work are breached, ordinary people feel the ripple effects. Your personal data can appear in the same underground markets that threat actors use to pressure public figures. Credential leaks from one incident frequently cascade into takeovers of personal email, social media, and financial accounts. For families, a single exposed phone number or reused password can link a parent’s professional life to children’s online identities, creating long-term privacy and safety risks that last years after the initial breach.

The Doxxing and Identity-Chain Risks

Private chats and internal files often contain metadata, phone numbers, email addresses, and personal details that allow attackers to map relationships between online handles and real-world identities. Once these links are established, subsequent doxxing attacks become easier and more damaging. Public reporting on similar incidents shows that published messages are frequently scraped, reposted, and combined with data from other breaches to build detailed profiles. Gaming accounts belonging to children are especially vulnerable because they often share the same household email or phone number used in professional communications, turning one institutional breach into a chain that can expose an entire family.

Handala Group’s Known Track Record

Public reporting attributes the Handala ransomware group with operations that emerged in recent years targeting Israeli and Western entities. Notable prior victims include organizations in government, defense-adjacent research, and technology sectors. The group’s typical playbook involves initial access through phishing or unpatched systems, followed by data exfiltration, then extortion demands directed at specific individuals. When payments are refused, the group publishes sensitive chats and internal files on dedicated leak sites, aiming to cause reputational damage and personal embarrassment rather than solely seeking financial gain. Readers can follow independent trackers for updated activity on this group.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains exist before attackers exploit them.
• Rotate any password used at the Israeli National Security Institute or related services anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that extends to your children’s gaming accounts and any shared family identifiers that could link back to this breach.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident shows that even targeted attacks on public institutions quickly become personal for anyone whose data is caught in the release. Acting quickly on credential hygiene and identity mapping can limit the damage before it spreads further. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand and close the gaps this type of leak creates for you and your family.