The 200,000 Message Bombshell: Bennett’s Game is Over Listed by handala Ransomware Group

On December 18, 2025, the Handala ransomware group publicly listed a new victim on its leak site, claiming to have exfiltrated internal files from an organization tied to former Israeli Prime Minister Naftali Bennett. The posting, which includes what the group describes as a 200,000-message “bombshell,” directly challenges Bennett’s public statements that his phone was never compromised.

What's Publicly Reported from Reporting

Public reporting indicates the Handala group posted the claim on its dark-web leak portal, accessible via an onion address tracked by ransomware.live. The announcement mocks Bennett’s recent video in which he denied any phone hack and dismissed related reports as false. Available reporting describes the exposed material as internal files exfiltrated during a ransomware incident, though the exact number of individuals whose personal data may be contained remains unknown at this time.

The group’s post explicitly references a large volume of messages—reported as 200,000—and uses them to accuse Bennett of lying. No independent verification of the full dataset has been published, but the listing itself confirms that Handala has chosen to escalate by making the claim public.

Why This Matters for You and Your Family

When high-profile figures experience data breaches, the same tactics quickly reach ordinary households. If attackers can obtain internal files containing emails, phone numbers, addresses, or linked accounts, those details often spread through underground markets. Your family’s information may already sit alongside data from similar incidents, waiting for someone to connect the dots.

Credential leaks like this one frequently cascade into account takeovers. A single exposed password used across personal email, banking, or children’s gaming accounts can give attackers persistent access. Once inside, they can harvest more data, impersonate family members, or launch further extortion attempts. The speed at which this happens leaves most people unaware until damage is already done.

The Doxxing and Identity-Chain Implications

Ransomware operators increasingly rely on identity chaining—linking an email address to a username, a phone number, a child’s gaming handle, and a physical address. A breach that begins with “internal files” can rapidly expand into full doxxing once these connections are mapped. Public reporting shows that children’s gaming accounts are frequent targets because parental credentials often protect them and because gamers reuse passwords across platforms.

Even if your name is not directly listed, information stolen from one organization can expose relationships that reveal your household. A single leaked message or contact list can serve as the starting point for attackers to build a complete profile of you and your family.

Handala Group’s Publicly Known Track Record

Public reporting attributes the Handala ransomware group with operations that emerged in recent years, focusing on both financial extortion and political messaging. The group has previously targeted organizations across multiple countries, often combining data theft with public shaming. Its typical playbook involves initial access through common vectors such as phishing or exploited remote services, followed by exfiltration of sensitive files and deployment of ransomware. When victims refuse payment, Handala posts samples or full datasets on its leak site, using mocking language to pressure the target. In this case, the group has chosen to highlight a political figure while threatening to release what it claims is highly embarrassing material.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can break the chains attackers rely on.
• Rotate any password you used at the breached organization anywhere else it appears, and immediately switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points for doxxing chains when parent credentials are exposed.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident demonstrates that data once considered safely stored inside an organization can surface months or years later with serious consequences for anyone whose information is included. Starting with a clear picture of your current exposure and maintaining ongoing visibility is the most practical defense available to ordinary families. DoxxScan by GalaxyWarden delivers exactly that combination—continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also protect children’s gaming accounts that frequently chain back to household identities.