High Group Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 2 May 2024, the ransomware group handala publicly listed High Group on its leak site, claiming to have conducted a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and independent confirmation of the intrusion or the full scope of any data taken has not been published. The listing itself is an unverified claim by the group.

For individuals and partners connected to High Group, the disclosure raises practical questions about what material may have left the organisation’s systems and how that material could be misused. Public detail is limited to the group’s own statements and the basic fact of the listing.

What happened

According to the reported summary of the listing, handala stated that it had “Hacked High Group” and that internal files were exfiltrated in a ransomware attack. The group described High Group as one of the main sources of settlement development in the occupied territories and claimed the company works with government ministries and large banks. It also issued a warning against any company or person taking action to build settlements. No technical details of the intrusion method, the precise date of the attack, the volume of data, or any ransom demand have been disclosed in the available record. The scale of impact on individuals is listed as unknown.

Who is handala?

Handala is a publicly documented threat actor that has operated under a pro-Palestinian banner and has repeatedly claimed responsibility for cyber operations against Israeli-linked organisations and companies it views as supporting settlement activity. The group typically publicises its actions on dedicated leak sites, often combining data-theft claims with political messaging. Its tactics have included ransomware-style encryption paired with data exfiltration, followed by threats to publish material if demands are not met. Prior listings have targeted entities in government, finance, construction and technology sectors. In this case the group claims it compromised High Group; that claim has not been independently verified in the facts available.

High Group and its sector

High Group operates in the construction and urban-development sector. Organisations of this type routinely manage project plans, land and property records, contracts with government bodies and financial institutions, employee and contractor information, and internal correspondence. Because the company is described by handala as engaged in settlement-related development, any successful breach could expose commercially sensitive planning data as well as personal details of staff, partners and residents connected to those projects. A compromise in this sector is consequential because the data often links physical locations, financial flows and personal identities, creating both operational and privacy risks.

The information in question

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” No further inventory—such as employee records, financial documents, customer lists or specific file counts—has been disclosed. Organisations engaged in large-scale development typically hold personnel files, contracts, architectural and engineering plans, banking correspondence and communications with public authorities. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat the precise contents as unknown until verified by the organisation or independent investigators.

The real-world impact

If internal files were indeed removed, affected individuals could face risks of identity misuse, targeted phishing, or unwanted exposure of personal or professional details. For High Group the consequences may include operational disruption, contractual disputes with partners, and the need to notify regulators or affected parties under applicable data-protection rules. Because the number of people affected is unknown and the exact data types remain limited to the generic description of internal files, the full extent of harm cannot yet be measured. The political framing of the claim may also increase the likelihood that any published material is circulated widely for activist purposes rather than purely financial ones.

Were you affected?

If you have worked with, contracted for, or supplied services to High Group, treat the listing as a prompt to review your own exposure rather than as confirmed proof that your data was taken. Practical first steps include:

• Monitor financial and email accounts for unusual activity and enable multi-factor authentication where available.
• Change passwords used on any shared or organisational systems and avoid reusing them elsewhere.
• Be alert to phishing messages that reference construction projects, settlements or High Group itself.
• Request clarification directly from High Group or its data-protection contact if you believe you hold a formal relationship with the company.
• Run a free exposure scan of your email address against known breach data sets to check whether your details have already appeared in public dumps.

Public information on this incident remains sparse. Further verified details from High Group or independent researchers would be required before the full picture can be established.

AICompiled with AI assistance from public sources and published under our editorial standards.