IDF in Farsi Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
IDF in Farsi was listed by the handala ransomware group, with internal files reported as exfiltrated in an attack disclosed on March 06, 2026; the date of the actual intrusion is not established. Anyone who may have shared data with the organisation should review their accounts and enable additional security measures.
What happened
On March 06, 2026, the handala group listed IDF in Farsi on its leak site. The group stated that internal files had been exfiltrated during a ransomware attack and described the material as including confidential information from Israeli army accounts along with 26 pages related to individuals connected to the Axis of Resistance countries. No further technical details, such as the method of intrusion or the timeline of the operation, have been disclosed by either the group or the organization.
The group behind it: handala
Handala is a ransomware operation that publicly lists victims on a dedicated leak site when ransom demands are not met. The group typically claims to have encrypted systems and removed data, then uses the site to pressure targets by publishing samples or descriptions of the material. Its listings are presented as evidence of access, though independent verification of each claim is often limited to what the group chooses to release.
About IDF in Farsi
IDF in Farsi refers to the Persian-language channels and pages maintained by the Israel Defense Forces. These platforms publish official statements, recruitment information, and operational updates aimed at Persian-speaking audiences. Organizations of this type routinely handle internal correspondence, personnel-related records, and coordination materials that are not intended for public release.
What data was at risk
The only detail released is that internal files were allegedly exfiltrated. The precise categories of information, such as names, contact details, operational documents, or account credentials, have not been confirmed by any party outside the group’s claim. Typical holdings for a military communications channel include staff directories, internal briefings, and correspondence; however, the actual contents of the claimed exfiltration remain unverified.
The real-world impact
Exposure of internal military files can affect operational security and the privacy of individuals referenced in those records. For the organization, the incident adds to the list of publicly discussed intrusions into defense-related communications. For any individuals named in the material, the main consequence is the possibility that information previously limited to official channels is now in wider circulation, though the scale of that circulation is not yet known.
If your data was in this claimed breach
Monitor official statements from IDF in Farsi for any guidance on the incident. Change passwords for any accounts that may have been referenced and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in previously published lists.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Aman Data Breach (2026)St. Joseph County Listed by handala Ransomware GroupIranWire Listed by handala Ransomware GroupKash Patel current director of the FBI Listed by handala Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the IDF in Farsi Listed by handala Ransomware Group →
Publicly posted by handala — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.