Vahid Offline Members Listed by handala Ransomware Group

On March 17, 2026, the handala Ransomware Group published a list containing the names and mobile phone numbers of 180,000 Iranian members of the Vahid Offline Telegram channel, data exfiltrated during a ransomware attack on the organization.

What's Publicly Reported from Reporting

Public reporting indicates the attackers gained access to internal files belonging to Vahid Offline, an Iranian organization, and later published the member list on their leak site. The exposed information includes full names paired with mobile numbers for the 180,000 individuals. No evidence has surfaced that payment information, financial records, or passwords were taken in this incident. The group posted a direct download link for the member database and included a mocking message urging victims to change their online handle from “Vahid Online” to “Vahid Offline.” Available reporting describes the data as having been exfiltrated during a standard ransomware operation before the public release.

Why This Matters for You and Your Family

When a list of 180,000 real names and mobile numbers appears on a ransomware leak site, the risk extends far beyond the original victims. Mobile numbers are frequently used as account recovery options across banking apps, messaging services, and government portals. If someone in your household reuses even a portion of their personal details across platforms, this exposure can serve as the first link in a chain that leads to account takeovers or targeted harassment. For families, the danger is multiplied because children and teenagers often share the same phone number for family plans or use parent-linked emails, creating a single point of failure that can affect everyone at home.

The Doxxing and Identity-Chain Implications

Names paired with mobile numbers allow attackers to cross-reference public records, social media profiles, and data from previous breaches. What begins as a simple lookup can quickly expand into full identity profiles that include home addresses, family relationships, and online usernames. Credential leaks like this one frequently cascade into gaming account takeovers, especially when children use the same phone number or email for Roblox, Fortnite, or Discord. Once an attacker controls a gaming account tied to a real phone number, they can pivot to social engineering friends and family members, turning a single breach into prolonged doxxing and harassment that follows your family across platforms.

Handala Ransomware Group's Track Record

Public reporting attributes the attack to the handala Ransomware Group, which emerged in late 2024. The group has targeted organizations across the Middle East with a consistent playbook: initial access through phishing or unpatched remote services, followed by exfiltration of internal databases and member lists, and finally public shaming on their leak site when ransom demands are not met. Notable prior victims include other Iranian and regional entities where member or customer contact data was published in similar formats. Their extortion style relies on embarrassment and the threat of further data dumps rather than sophisticated technical exploits after the initial breach.

What to do

• Run a DoxxScan to map every link between your names, phone numbers, emails, and online handles across 13.1B+ breach records and 100+ platforms.
• Rotate any password tied to Vahid Offline or any Iranian service where the same credentials are reused, and switch to 2FA using an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and addressed within hours rather than months.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same phone numbers or addresses.
• Let remediation specialists handle takedown requests and broker removals so you do not have to chase data brokers yourself.

The publication of 180,000 names and mobile numbers shows how quickly personal data moves from a single organization’s servers to public leak sites. Protecting yourself and your family now requires more than changing one password; it demands visibility into how your information connects across the internet and decisive action to break those chains. Start your DoxxScan trial and let its continuous monitoring across 13.1 billion+ breach records, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage—including children’s gaming accounts—work on your behalf.