Braverman Files Unleashed: Every Secret Now Exposed Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Prime Minister's Office was listed on December 28, 2025, by the group handala as the target of a ransomware operation that resulted in the exfiltration of internal files. Public details remain limited: the number of individuals affected is not stated, the volume or contents of the files are not specified, and no independent confirmation of the data's authenticity or scope has been released. This incident occurs amid a broader pattern of ransomware and data-exfiltration activity directed at government institutions, where threat actors seek both financial leverage and political visibility through the publication of stolen material.

Breaking down the breach

The available facts indicate that handala listed the Prime Minister's Office on its leak site and described the event as involving internal files taken during a ransomware attack. No exact date of the intrusion, no file counts, and no description of the encryption or exfiltration methods have been disclosed. The organisation has not publicly confirmed the claim or provided an official statement on the extent of any compromise.

The group behind it: handala

Handala is a ransomware operator that maintains a leak site to publish data obtained from victims. The group has conducted operations against organisations in multiple sectors, frequently combining encryption of systems with the threat or actual release of stolen files. Its activity is documented in public reporting on ransomware campaigns that target both private and public entities, often with an emphasis on high-profile victims to increase pressure for payment or to draw attention to the group's claims.

About Prime Minister's Office

The Prime Minister's Office functions as the central administrative body supporting the head of government. It routinely handles policy coordination, personnel records, security briefings, and inter-agency communications. Because of the nature of its work, such offices maintain large volumes of sensitive internal correspondence and operational documents whose exposure can affect ongoing government functions and the privacy of individuals referenced in those records.

The information in question

The listing states that internal files were exfiltrated. No further breakdown of data categories, such as specific document types or personal identifiers, has been provided. Organisations of this type commonly store correspondence, meeting records, and administrative files; however, the precise contents of any material claimed by handala remain unconfirmed.

Why it matters

Exposure of internal government files can create operational risks by revealing decision-making processes or contact information. Where personal data is present, individuals referenced in the files may face secondary risks such as targeted phishing or misuse of their details. For the organisation, the incident adds to the workload of verifying the scope of access and managing any resulting diplomatic or administrative consequences.

If your data was in this claimed breach

Monitor official communications from the Prime Minister's Office for any guidance on affected individuals. Review recent account activity for signs of unauthorised access and change passwords for any services that may have been referenced in internal records. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.