EPS Tech Ltd Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 15 August 2024, the ransomware group known as handala publicly listed EPS Tech Ltd on its leak site, claiming to have hacked the company and exfiltrated internal files. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the intrusion or the precise contents of any stolen material has been released. The listing matters because EPS Tech Ltd designs and supplies advanced embedded electronic systems for defence and military customers; any successful theft of internal files from such an organisation can carry operational, commercial and personal consequences that extend beyond the company itself.

The group’s own description frames EPS Tech Ltd as a provider of sensitive military and security infrastructure. That characterisation is a claim made by handala and has not been independently verified in the available public record. What is established is simply that the company has been named as a victim of a ransomware-related data-exfiltration incident.

What happened

According to the 15 August 2024 listing, handala claims to have conducted a ransomware attack against EPS Tech Ltd that resulted in the exfiltration of internal files. No further technical details—such as the initial access vector, the duration of access, the volume of data taken, or any ransom demand—have been disclosed in the public reporting. The number of individuals whose information may have been involved is listed as unknown. The only concrete assertion available is that internal files were removed as part of the attack. Whether those files have been published, sold, or retained solely as leverage remains unconfirmed.

Inside handala

Handala is a publicly documented threat actor that has repeatedly claimed responsibility for ransomware and data-leak operations, frequently directing its activity at organisations it associates with Israeli defence, intelligence or government interests. The group typically combines network intrusion with data theft, then advertises the victim on a dedicated leak site to apply pressure. Its statements often mix technical claims with political rhetoric; independent verification of those statements is rarely available at the moment of publication. In this instance, the listing of EPS Tech Ltd follows the same pattern: the group asserts a successful breach and characterises the victim in strongly worded terms, yet supplies no forensic evidence that third parties can immediately examine. Prior campaigns attributed to handala have shown a preference for exfiltrating documents that can be portrayed as strategically sensitive, then releasing samples or full archives if negotiations stall. None of those earlier patterns prove the accuracy of the current claim against EPS Tech Ltd; they merely illustrate the group’s established operating style.

About EPS Tech Ltd

EPS Tech Ltd is described in open sources and in the group’s own summary as a designer and provider of advanced embedded electronic systems serving defence and military markets. Organisations of this type routinely handle engineering drawings, firmware, supply-chain records, project documentation and contractual material that relate to national-security customers. Because the work involves specialised hardware and software intended for military use, the compromise of internal files can expose proprietary designs, supplier relationships and operational details that competitors or adversaries might exploit. The handala listing further asserts that EPS Tech Ltd functions as a shell company linked to Unit 8200 and is managed by an individual named Daniel Applebaum; these assertions remain unverified claims made by the threat actor and should be treated as such until corroborated by independent evidence. Regardless of the accuracy of the political framing, the company’s sector alone makes any confirmed breach consequential for both commercial intellectual property and broader security interests.

What was likely exposed

The only data category named in the available facts is “internal files exfiltrated in a ransomware attack.” Exact file names, volumes, or classifications have not been disclosed. Organisations that design embedded systems for defence customers typically maintain repositories of technical schematics, source code, test results, employee records, vendor contracts and correspondence with government clients. Whether any of those categories were among the material allegedly taken from EPS Tech Ltd is unconfirmed. Public reporting does not list personal data fields, financial records, or classified documents as verified contents of the theft. Until samples or a fuller inventory appear, the precise exposure remains unknown.

• Confirmed claim: internal files removed during a ransomware incident
• Unconfirmed: volume, classification level, or specific document types
• Unconfirmed: presence of personal identifiers, credentials, or customer data
• Unconfirmed: whether any material has been publicly released beyond the initial listing

The real-world impact

For individuals whose personal or professional information may have been stored on EPS Tech Ltd systems, the principal risks are identity misuse, targeted phishing, and potential exposure of employment or security-clearance details. Because the company operates in the defence sector, even non-personal technical files can create secondary risks: reverse-engineering of proprietary designs, disruption of supply chains, or intelligence value for foreign actors. For the organisation itself, the incident—if substantiated—can lead to contractual reviews by military customers, regulatory scrutiny, and long-term reputational damage. No public figures for financial loss or operational downtime have been released, so the scale of those effects cannot yet be quantified. The absence of confirmed victim counts also means that the number of people who should take protective steps is still unclear.

Were you affected?

If you have ever worked for, contracted with, or supplied EPS Tech Ltd, treat the possibility of exposure as real until more detail emerges. Practical first steps include changing passwords used on any company-related accounts, enabling multi-factor authentication wherever available, and monitoring financial and credit activity for unusual behaviour. Review email accounts for spear-phishing messages that reference defence projects or internal terminology. Readers can also run a free exposure scan of their email address against known breach data sets to determine whether their information has already appeared in public dumps. Continue to watch official company notices and reputable cybersecurity reporting for any later confirmation of the handala claim or for guidance issued by EPS Tech Ltd itself.

AICompiled with AI assistance from public sources and published under our editorial standards.