Elad municipality Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In a period marked by persistent ransomware and hacktivist campaigns against public institutions, especially those linked to regions of geopolitical tension, local governments remain frequent targets because of the sensitive records they manage and the essential services they provide. Against that backdrop, the listing of Elad municipality by the handala group, reported on 3 November 2024, stands as one more instance of a claimed intrusion into municipal systems. Public detail remains limited to the group’s own statements, yet the episode underscores why such incidents matter: they can disrupt daily administration and place residents’ personal and operational data at risk.

What is known comes almost entirely from the threat actor’s leak-site claims. No independent confirmation of the scale, method or full impact has been published in the available record, and the number of people affected is listed as unknown. The following account therefore treats the group’s assertions as claims rather than established fact, while situating them in the wider pattern of attacks on municipal infrastructure.

Inside the incident

On 3 November 2024 Elad municipality was listed by the handala ransomware group. The group’s own summary asserts that it “hacked the airgap network of Elad Municipality,” that the municipality was closed that day, and that “all main file and database servers as well as the systems of all employees were wiped.” It further claims that “more than 3TB of confidential data, including the main database of the municipality, all files, identity specifications and geographic coordinates, contracts, etc., were dumped.” The available facts describe the event as a ransomware attack in which internal files were exfiltrated. Timing beyond the report date, the precise technical vector, and any independent verification of the volume or completeness of the alleged dump remain undisclosed. The number of individuals whose information may have been involved is likewise unknown.

The group behind it: handala

Handala is a publicly documented hacktivist collective that has repeatedly claimed responsibility for cyber operations against Israeli organisations, often framing its activity in political terms. The group typically publicises alleged breaches on leak sites, asserts data theft and system disruption, and sometimes releases sample files to support its claims. Its tactics have included ransomware-style encryption or wiping of systems alongside data exfiltration, and it has previously targeted government, municipal and critical-infrastructure entities. In this case the listing of Elad municipality is presented solely as the group’s claim; no confirmation that the group successfully executed every asserted action is contained in the facts provided. Readers should therefore regard the specific assertions about air-gapped networks, system wiping and the 3 TB volume as unverified statements by the actor itself.

Elad municipality and its sector

Elad municipality is a local government body responsible for civic administration, planning, public services and resident records within its jurisdiction. Municipalities of this type routinely maintain databases of residents’ identities, property and geographic information, contracts with suppliers, internal correspondence and operational systems that support day-to-day services. A breach affecting such an organisation is consequential because it can interrupt public services, expose administrative continuity, and place personal data of residents and employees in the hands of unauthorised parties. Even when the precise technical details remain unconfirmed, the mere listing of a municipality by a threat actor raises legitimate concern for anyone whose records may be held by the authority.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” The group’s summary additionally claims that the dump included the main municipal database, all files, identity specifications, geographic coordinates and contracts, amounting to more than 3 TB. Because these details originate solely from the actor’s statements, they are treated here as claims rather than verified inventory. Organisations of this kind typically hold identity and contact information for residents and staff, property and planning records, contractual documents and internal operational files. The exact contents of any data that may have left the municipality’s control remain unconfirmed, and the number of people potentially affected is unknown.

The real-world impact

If the group’s claims are accurate even in part, residents and employees could face risks of identity misuse, targeted phishing or social-engineering attempts that leverage authentic-looking municipal data. Geographic and contractual information could assist further reconnaissance against the municipality or its partners. For the organisation itself, the alleged wiping of servers and employee systems would imply temporary or prolonged disruption of administrative functions, possible recovery costs, and the need to rebuild trust with the public. Because the number of affected individuals is unknown and independent verification is absent, the concrete scale of harm cannot be quantified from the available record; the primary impact at present is the uncertainty and the precautionary steps that potentially exposed parties should consider.

What to do if you're exposed

Anyone who has dealt with Elad municipality—residents, employees or contractors—should treat the possibility of exposure seriously even while details remain unconfirmed. Monitor bank and credit statements for unusual activity, enable multi-factor authentication on email and government portals, and be alert to phishing messages that reference municipal services or personal details. Change passwords on any accounts that may have reused credentials linked to municipal interactions. Consider placing a fraud alert with credit-reporting services if identity documents could have been involved. As a practical first check, readers can run a free exposure scan of their email address to see whether that address has already appeared in known breach data sets; such a scan does not confirm involvement in this specific incident but can indicate whether further vigilance is warranted. Official guidance from the municipality, once issued, should take precedence over any third-party claims.

AICompiled with AI assistance from public sources and published under our editorial standards.