Freedom Wood Doors Ltd Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups and hacktivist collectives continue to target manufacturers and mid-sized firms that hold operational and customer records, often publishing claims of data theft on leak sites to pressure victims. In this landscape, listings appear frequently and require careful scrutiny because public confirmation of every detail is rarely immediate.

On 6 July 2025, Freedom Wood Doors Ltd, a manufacturer of interior doors based in Hod HaSharon, was listed by the handala ransomware group. The group claims the company suffered a ransomware attack in which internal files were exfiltrated. The number of people affected remains unknown, and independent verification of the full scope has not been publicly detailed beyond the listing itself. The incident matters because the claimed data includes client lists and project materials that could affect private households, contractors and entities linked to government work.

Inside the incident

Public reporting states that Freedom Wood Doors Ltd was listed by handala after an alleged ransomware attack involving the exfiltration of internal files. The reported summary describes a data leak that includes full client lists covering private residences, contractors and several government-linked entities, along with invoices, delivery schedules, internal price quotes, technical specifications and door schematics for custom projects. A figure of 92 GB is associated with the claimed dump. Timing of the intrusion itself, the precise method of initial access, and any ransom demand details are not disclosed in available records. The listing is presented as a claim by the group; confirmation from the company or independent forensic sources is not part of the public facts provided.

The group behind it: handala

Handala is a known threat actor that has operated in the ransomware and data-leak space, frequently posting claims against organisations it associates with Israeli interests. Publicly documented activity shows the group using leak sites to publish or threaten publication of stolen data, often framing operations in political terms. Typical tactics include claiming large-scale file exfiltration and releasing samples or full archives to demonstrate possession. The group’s listings are assertions; they do not automatically constitute verified proof of every detail for any single victim. In this case, handala’s claim is limited to the listing of Freedom Wood Doors Ltd and the description of internal files taken in a ransomware attack. No further statements attributed specifically to this victim beyond that listing appear in the facts.

Freedom Wood Doors Ltd and its sector

Freedom Wood Doors Ltd manufactures interior doors and is based in Hod HaSharon. Companies in this sector routinely manage customer orders for residential and commercial projects, maintain supplier and contractor relationships, and store technical drawings and pricing for custom work. Such organisations commonly hold contact details, delivery addresses, invoice histories and design files that support day-to-day operations. A breach involving these materials is consequential because it can expose both private individuals who ordered doors for their homes and any institutional or government-linked clients whose projects appear in the records. The sector’s reliance on detailed project documentation means that schematics and schedules, if released, can reveal operational patterns that are not intended for public view.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The reported summary lists full client lists that include private residences, contractors and several government-linked entities; invoices; delivery schedules; internal price quotes; and technical specifications and door schematics for custom projects, with a claimed volume of 92 GB. Exact contents of every file remain unconfirmed outside the group’s claim and the summary provided. Organisations of this type typically hold customer contact information, project addresses, financial records of orders, and proprietary design data. Whether every category was fully present or complete cannot be stated as verified fact from the available record.

Why it matters

For individuals whose names or addresses appear on client lists, the practical risks include unwanted contact, targeted phishing that references real orders, or exposure of residential details. Contractors and any government-linked entities named in the materials could face similar social-engineering attempts or competitive disadvantage if pricing and delivery schedules become public. For the company, the consequences include potential regulatory scrutiny, loss of customer trust, and the operational cost of investigating and containing the incident. Because the number of affected people is unknown, the full scale of personal impact cannot yet be measured. The combination of personal and project data raises the possibility of both privacy harm and business disruption without requiring sensational claims.

What to do if you're exposed

If you have done business with Freedom Wood Doors Ltd or believe your details may appear in the claimed files, monitor financial statements and email accounts for unusual activity. Change passwords on any accounts that reused credentials linked to the company, and enable multi-factor authentication where available. Be cautious of unsolicited messages that reference door orders, invoices or delivery dates. Readers can run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Official guidance from local data-protection authorities should be followed if further confirmation of personal data exposure emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.