Ignite Chaos at Your Own Risk: i24 Channel Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 21, 2026, the handala ransomware group listed i24 Channel on its leak site and stated that it had carried out a ransomware operation against the organization several weeks earlier. The group described the intrusion as a deliberate action rather than random disruption and indicated that internal files had been removed. The number of individuals whose information may be involved remains unknown, and no further technical details about the intrusion have been released publicly.

The incident matters because i24 Channel, like other media outlets, routinely handles internal documents that can include operational records, communications, and employee information. When such material is taken and later listed for release, the people connected to those records face the possibility that their details will become public without their knowledge or consent.

Breaking down the breach

The only confirmed information is the date the listing appeared and the group’s assertion that files were exfiltrated during a ransomware attack. No statement has been issued on the volume of data, the encryption status of systems, or whether any material has been published. The organization has not confirmed or denied the claims, and independent verification of the intrusion has not been made public.

The group behind it: handala

Handala is a ransomware operator that has previously claimed responsibility for intrusions into organizations it selects. Public reporting on the group shows it tends to announce activity through leak-site postings rather than widespread media statements, and it has focused on targets connected to specific geopolitical contexts. In this case the group claims it conducted a calculated operation against i24 Channel and chose to remain silent until the listing appeared; that claim has not been corroborated by other sources.

i24 Channel and its sector

i24 Channel is an international news broadcaster based in Israel that produces reporting for audiences outside the country. Media organizations of this type maintain internal systems that store production materials, staff records, and business correspondence. A successful intrusion into such an environment can expose both the outlet’s own operations and any personal information that appears in routine files.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been provided. Organizations in the news sector commonly hold employee contact details, internal emails, and production documents, yet it is not confirmed whether any of these categories were among the material removed. The exact contents therefore remain unconfirmed.

The real-world impact

Individuals named in the exfiltrated files could see their contact information or professional details circulated if the material is later released. For the organization, the incident adds operational strain from any required containment work and from the uncertainty over what, if anything, will be published. Both outcomes depend on actions that have not yet occurred and on information that has not been disclosed.

Were you affected?

Because the number of people involved and the precise data types have not been published, it is not currently possible to determine individual exposure from official statements. People who have had professional contact with i24 Channel can monitor their email accounts for unusual activity and consider changing passwords on any services that may share the same credentials. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in previously published listings.

AICompiled with AI assistance from public sources and published under our editorial standards.