Targets Locked: The Minds Behind Arrow and David’s Sling Are Revealed Listed by handala Ransomware Group

On December 13, 2025, the Handala ransomware group published the names of 13 principal architects of Israel’s Arrow and David’s Sling missile defense systems, exposing individuals whose personal details were taken during a ransomware attack on a defense contractor.

What's Publicly Reported from Reporting

Public reporting indicates the group exfiltrated internal files during a ransomware operation and later listed the victims on its leak site. The announcement specifically named 13 engineers and scientists described as key contributors to the Arrow and David’s Sling programs. A $30,000 reward was offered for additional information about these individuals. Available reporting describes the data as internal files; the exact volume and full range of personal information remain unclear. The incident follows the group’s pattern of naming individuals tied to Israeli defense work.

Why This Matters for You and Your Family

When names of engineers working on classified projects appear on a public ransomware site, the risk extends beyond the immediate targets. Personal details linked to those names can be combined with other leaked data to locate home addresses, family members, and online accounts. If you or anyone in your household has ever worked in defense, technology, government contracting, or even shares a surname or address with someone who does, the same data trails can lead to you. Credential leaks from one breach frequently cascade into gaming accounts, email, and social media, putting children’s profiles at risk of harassment or takeover.

The Doxxing and Identity-Chain Implications

Once a name surfaces in a high-profile leak, attackers and opportunistic individuals begin linking it across dozens of platforms. A single exposed email or phone number can reveal LinkedIn profiles, gaming usernames, family photos, and residential records. This creates an identity chain that grows quickly. Public reporting shows these chains often lead to doxxing campaigns, swatting attempts, or extortion demands. For families, the exposure of one parent’s professional details can place children’s gaming accounts and school-related profiles in the crosshairs, especially when the same passwords or recovery information are reused.

Handala’s Publicly Known Track Record

Public reporting attributes the group’s emergence to operations focused on Israeli targets. Handala RedWanted has conducted multiple campaigns against organizations and individuals connected to Israeli defense and government interests. Its typical playbook involves initial ransomware deployment, exfiltration of internal documents, and publication of sensitive files on leak sites when demands are not met. The group frequently names specific employees, offers rewards for further information, and uses the publicity to pressure victims. Exact details of prior victims vary across reports, but the pattern of targeting defense-linked entities and releasing personal identifiers is consistent in available coverage.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see the exposure chains before attackers do.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours rather than months.
• Rotate every password used at the breached contractor or any related service, replace reused credentials immediately, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points when parent credentials are exposed.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate or chase down each instance yourself.

The pace of these leaks continues to accelerate, and waiting to see whether your information surfaces is no longer a viable strategy. One practical step now can break the chain before it reaches your family. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage extends to children’s gaming accounts that frequently become targets when credential leaks cascade into full doxxing sequences.