Naftali Bennett Chats Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Naftali Bennett Chats has been listed by the handala ransomware group, with internal files reportedly exfiltrated; the incident came to light on 17 December 2025. Individuals who may have communicated with the organisation should review their accounts and take steps to protect their information.
Inside the incident
The incident was first reported on December 17, 2025. The handala group claims responsibility for exfiltrating internal files and states that it is publishing 1,900 chats obtained directly from the device. Naftali Bennett has publicly denied that any breach occurred and maintains that his phone was never compromised. No independent confirmation of the claims, the number of records, or the method of access has been established in available reporting. The number of individuals affected remains unknown.
The group behind it: handala
Handala is a publicly documented threat actor that has conducted operations against Israeli-linked targets in recent years. The group typically employs data exfiltration followed by public listings on leak sites to draw attention to its actions. Its listings are presented as claims by the group itself; independent verification of the data’s origin or completeness is not provided in the current record.
Who is Naftali Bennett Chats?
Naftali Bennett Chats refers to communications associated with Naftali Bennett, who served as Prime Minister of Israel from 2021 to 2022. Entities of this nature commonly hold messaging records, contact lists, and related administrative material. A breach affecting such data is consequential because it involves the private exchanges of a former head of government, where even limited exposure can intersect with matters of public interest and personal privacy.
What data was at risk
The listing describes internal files exfiltrated in a ransomware-style operation. The group claims these include 1,900 chats. No further inventory of file types, timestamps, or specific content categories has been confirmed. Organisations handling political or personal communications typically retain message histories, metadata, and attached documents, yet the precise contents in this case remain unconfirmed beyond the group’s statements.
What's at stake
For individuals whose information appears in the material, the primary concerns are loss of confidentiality around personal or professional exchanges. For the organisation or individual involved, the incident raises questions about the security of mobile devices used for sensitive discussions. No evidence of subsequent misuse of the data has been reported at this stage.
Were you affected?
Individuals concerned about possible exposure should first verify whether their contact details or identifiers appear in any public listings associated with the incident. Practical next steps include:
- Monitoring official statements from Naftali Bennett’s office for any confirmed guidance.
- Running a free exposure scan of your email address against known breach datasets.
- Reviewing device security settings and enabling multi-factor authentication on messaging applications.
Further details on the scope of any exposure are not yet available from verified sources.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Braverman Files Unleashed: Every Secret Now Exposed Listed by handala Ransomware GroupBibi Gate: The Gatekeeper’s Fall | Tzachi Braverman Listed by handala Ransomware GroupNetanyahu’s Cabinet Awaits Handala’s Next Move Listed by handala Ransomware GroupShelter Locations in Israel Listed by handala Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Naftali Bennett Chats Listed by handala Ransomware Group →
Publicly posted by handala — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.