Caught by the Octopus: Bennett’s Darkest Hour Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is that on December 17, 2025, the handala ransomware group listed an entity styled “Caught by the Octopus: Bennett’s Darkest Hour” on its leak site and stated that internal files had been taken. The number of individuals whose information may be involved remains undisclosed, as do the precise contents of any files. For people connected to the organisation, the practical concern is whether documents containing personal identifiers, communications or operational records have left its control.

What happened

The listing appeared on December 17, 2025. The group posted a message addressed to Naftali and asserted that internal files had been exfiltrated during a ransomware operation. No figure for the volume of data, the number of records, or the date of the intrusion has been released. Confirmation that the files have been published or sold has not been provided.

The group behind it: handala

Handala is a ransomware operator that maintains a leak site to advertise claimed intrusions. Its public statements typically combine political messaging with assertions that data has been removed from targeted systems. The December 17 post frames the listing as part of the group’s second-anniversary activity and references prior targeting of political figures. The claim that files from this specific organisation were taken rests solely on the group’s statement.

Who is Caught by the Octopus: Bennett’s Darkest Hour Listed by handala Ransomware Group?

The name given in the listing points to material connected with Naftali Bennett, a former Israeli prime minister. Entities or projects bearing such titles are typically involved in political commentary, media production or archival work. Organisations of this nature routinely hold correspondence, internal planning documents, contact lists and administrative records.

The information in question

The only data category named in the listing is “internal files exfiltrated in ransomware attack.” No inventory of file types, no sample documents and no confirmation of personal data categories have been supplied. Organisations handling political or media content commonly store names, contact details, meeting records and draft materials; whether any of these were present in the claimed exfiltration is unconfirmed.

Why it matters

Internal files can contain identifying information about staff, sources or correspondents. If released, such material may be used for further targeting, impersonation or public exposure. The organisation faces the task of verifying the scope of any loss and managing possible follow-on contact from individuals named in the records.

If your data was in this claimed breach

Begin by changing passwords for any accounts linked to the organisation and enabling multi-factor authentication. Monitor official statements from the entity for guidance on affected individuals. Review bank and government-service accounts for unusual activity. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in previously published lists.

• Change passwords and enable multi-factor authentication on linked accounts.
• Watch for official notices from the organisation.
• Check financial and official accounts for signs of misuse.
• Use a free breach-exposure scan on your email address.

AICompiled with AI assistance from public sources and published under our editorial standards.