GNS Cloud Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 December 2024, the ransomware group handala publicly listed GNS Cloud on its leak site, claiming to have carried out a sophisticated cyber attack that exfiltrated internal files. The number of people affected remains unknown, and public detail on the precise scope is limited. For customers, partners and employees who rely on the company for cloud services, the listing raises immediate practical questions about whether their information or systems could be among the material the group says it took.

Because cloud providers sit at the centre of many organisations’ operations, any confirmed or claimed compromise can affect not only the provider itself but also the clients whose data and workloads rest on its infrastructure. Until more verified information emerges, those potentially connected to GNS Cloud have little choice but to treat the claim seriously and take basic protective steps.

What happened

According to the reported listing, handala claimed responsibility for a ransomware attack against GNS Cloud in which internal files were exfiltrated. The group’s own statement framed the incident as “a calculated act of revenge for the martyrdom of Reza Avazeh, a distinguished cyber security scientist of Hezbollah,” and asserted that GNS Cloud is “Israel Largest Cloud Company” while declaring “None of your data is safe now!” and questioning the firm’s ability to secure itself. The listing was reported on 16 December 2024. No independent confirmation of the attack’s success, the volume of data taken, or the technical method used has been supplied in the available facts; the people affected figure is listed as unknown, and further operational details remain undisclosed.

Who is handala?

Handala is a pro-Palestinian hacktivist and ransomware-linked group that has repeatedly claimed operations against Israeli organisations and entities perceived as supporting Israeli interests. Public reporting over recent years has associated the group with data-leak sites, claims of network intrusion, and politically motivated messaging that often references regional conflicts. The group typically publicises alleged victims on dedicated leak platforms, sometimes releasing sample files or full archives to pressure targets. In this case the group claims to have struck GNS Cloud; that claim has not been independently verified in the facts provided, so it should be treated as an unverified assertion by the actors themselves rather than established fact.

About GNS Cloud

GNS Cloud operates as a cloud-service provider. The handala listing characterises it as Israel’s largest cloud company; whether or not that ranking is precise, organisations of this type typically supply infrastructure-as-a-service, platform services, storage, and related managed offerings to commercial and institutional customers. Such providers routinely hold customer account data, configuration files, virtual-machine images, backups, and internal operational documents. A breach or claimed breach at a cloud firm is consequential because the same infrastructure may support many third-party organisations; any compromise can therefore create secondary exposure for those clients even if their own systems were never directly attacked.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, volumes, or specific data categories has been disclosed. Organisations in the cloud-services sector commonly store material such as:

• Customer account records and billing information
• Internal configuration files, access credentials and network diagrams
• System logs, backup images and operational documentation
• Employee or contractor contact details and administrative records

Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the material handala claims to hold. Readers should treat any assertion of specific data types beyond “internal files” as unverified.

The real-world impact

For individuals and organisations whose data may have been present on GNS Cloud systems, the primary risks are misuse of any credentials or personal information that could appear in the claimed files, potential secondary attacks that leverage leaked configuration details, and the practical disruption that follows when a cloud provider must investigate and remediate. Customers may face temporary service interruptions, forced password resets, or the need to migrate workloads. The organisation itself confronts reputational damage, possible regulatory scrutiny, and the cost of forensic work and customer notification—costs that are not quantified in the available facts. Because the number of people affected is unknown and the precise data set is undisclosed, the full extent of these impacts cannot yet be measured.

What to do if you're exposed

If you are a customer, partner or employee of GNS Cloud, or if you simply used an email address associated with any of its services, take the following practical first steps:

• Change passwords on any accounts that may have been linked to GNS Cloud services and enable multi-factor authentication where available.
• Monitor financial and email accounts for unusual activity and consider placing fraud alerts with credit bureaus if personal identifiers could be involved.
• Review access logs or notifications from other cloud or SaaS providers for signs of unauthorised logins that might stem from reused credentials.
• Preserve any relevant correspondence or invoices in case further official notifications appear.

Readers can also run a free exposure scan of their email address to check whether that address has already surfaced in known breach data sets. Until GNS Cloud or independent investigators release verified details, these basic measures remain the most concrete actions available to those who may be affected.

AICompiled with AI assistance from public sources and published under our editorial standards.