Israel 99 Digital! Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 13, 2024, the ransomware group handala publicly listed Israel 99 Digital! as a victim, claiming it had conducted a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and independent confirmation of the full scope has not been established in available public records. The listing itself is a claim by the group rather than a verified disclosure from the organisation.

Such claims matter because they can place individuals and partner organisations at risk of further targeting, even when exact details stay limited. Readers connected to Israel 99 Digital! or similar digital-sector entities in the region should treat the incident as a potential exposure event and take measured steps to protect themselves.

What happened

According to the reported listing, handala claimed to have hacked Israel 99 Digital! and exfiltrated internal files as part of a ransomware attack. The group’s own statement described the action as a message directed at certain Israeli entities, asserted that more than 500,000 alert messages had been sent, and claimed that 5.2 TB of data drawn from sensitive conversations of organisations had been dumped. Public detail on the precise timing of the intrusion, the technical method used, or any ransom demand is limited. The number of people affected is unknown, and no independent verification of the volume or contents of the claimed data has been published in the available record. The incident is therefore known primarily through the group’s leak-site listing rather than through confirmed organisational disclosure.

Inside handala

Handala is a threat actor that has publicly positioned itself as a pro-Palestinian hacking group. It has a documented pattern of targeting Israeli organisations and entities perceived as linked to Israeli interests, often combining data theft with politically charged messaging. Public reporting on the group describes operations that include ransomware deployment, data exfiltration, and the subsequent publication of stolen material on leak sites or through mass messaging campaigns. The group frequently frames its actions in terms of retaliation or deterrence and has claimed prior activity against a range of Israeli government, military-adjacent, and private-sector targets. In this case the group claims responsibility for the listing of Israel 99 Digital!; those claims have not been independently confirmed by the victim organisation in the facts available.

About Israel 99 Digital!

Israel 99 Digital! operates in the digital and technology sector in Israel. Organisations of this type typically provide digital services, platforms, or related technology solutions and therefore hold internal operational files, business correspondence, and data belonging to clients or partners. Public background on the precise size, client base, or internal structure of Israel 99 Digital! is limited. A breach affecting such an organisation is consequential because digital-sector firms often serve as intermediaries for other businesses and may store sensitive conversational or project data that, if exposed, can create secondary risks for those partners. The geopolitical context in which the claim was made further elevates the potential for the incident to be used for broader messaging or follow-on activity.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The group further claimed that 5.2 TB of data from sensitive conversations of organisations had been dumped. Exact data types beyond the description “internal files” and the group’s assertion about conversational material are not independently detailed in the public record. Organisations operating in the digital sector commonly hold business emails, project documentation, client records, internal communications, and operational files. Whether any of those categories were present in the claimed dump remains unconfirmed. Readers should therefore treat the precise contents as undisclosed pending further verified information.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks include targeted phishing, social-engineering attempts that reference genuine business details, and potential identity or credential misuse if personal data was present. For partner organisations whose conversations or files may have been included, the exposure can enable competitive intelligence gathering or further intrusion attempts. The organisation itself faces operational disruption, possible regulatory scrutiny, and reputational pressure, particularly when a politically motivated actor publicises the claim. Because the number of people affected is unknown and the exact data set is unconfirmed, the scale of individual harm cannot yet be quantified; the prudent assumption is that any internal material could be leveraged for secondary attacks. The group’s claim of mass alert messages also raises the possibility of widespread harassment or misinformation campaigns directed at those it labels as targets.

If your data was in this claimed breach

If you have a past or present relationship with Israel 99 Digital! or believe your information could have been stored in its systems, begin by monitoring accounts for unusual activity and enabling multi-factor authentication wherever possible. Change passwords on any accounts that may have shared credentials or been referenced in business communications. Remain alert for phishing messages that cite the organisation or recent events, and treat unsolicited contacts claiming to hold your data with caution. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities. Public detail remains limited, so continued vigilance is the most practical immediate step.

AICompiled with AI assistance from public sources and published under our editorial standards.