Mossad’s Secret Treasury Exposed: 50,000 Confidential Emails Leaked Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A data breach claim involving internal files from an organization tied to Israeli intelligence finance functions was reported on March 17, 2026. The handala Ransomware Group listed the incident on its leak site, though independent confirmation of the exfiltration or its scope remains unavailable. Public detail on the number of people affected is unknown.

What happened

The incident centers on a claim by the handala Ransomware Group that it obtained internal files through a ransomware operation. The listing appeared on March 17, 2026. No further details on the intrusion method, timeline of access, or volume of material have been disclosed in available reporting.

Inside handala

Handala is a ransomware operator that maintains a public leak site to post data it claims to have taken from targeted organizations. The group has previously listed victims across multiple sectors and uses such postings to apply pressure during extortion attempts. Its listing of any specific victim constitutes a claim by the group rather than an independently verified event.

Mossad’s Secret Treasury Exposed: 50,000 Confidential Emails Leaked Listed by handala Ransomware Group and its sector

The affected entity is described in connection with Ilan Steiner, identified as a former Budget Director at Mossad and current Chief Financial Officer of Israel’s National Security Institute. Organizations of this type manage sensitive administrative and financial records that support national security functions. A breach involving such an entity raises questions about the protection of internal communications and planning documents.

The information in question

The only data type named in the available facts is internal files exfiltrated during a ransomware attack. Exact contents, file categories, or confirmation of any email volume have not been disclosed. Organizations handling national security budgets and research typically retain financial records, personnel correspondence, and operational planning material, yet the precise material from this incident remains unconfirmed.

Why it matters

Exposure of internal files from a national security finance function can reveal administrative relationships and resource allocation details that adversaries may analyze over time. For individuals whose information appears in such records, the primary risks involve targeted follow-on activity rather than immediate public disclosure. The absence of confirmed data types limits precise assessment of downstream effects.

If your data was in this claimed breach

Individuals concerned about possible exposure should begin by monitoring official statements from the affected organization and any subsequent verified reporting. Practical first steps include:

• Changing passwords for any email or administrative accounts that may have been referenced in the files.
• Enabling multi-factor authentication on all accounts that store or process sensitive correspondence.
• Reviewing financial and personnel records for any unusual activity in the months following the reported date.

Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.