Operation Octopus: Naftali Bennett Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
On December 17, 2025, the handala ransomware group publicly listed former Israeli Prime Minister Naftali Bennett under the title “Operation Octopus,” claiming to have exfiltrated internal files. Individuals or organisations referenced in the disclosure should review the published material and implement any recommended security measures.
What happened
The incident centers on a public claim by the handala group that it accessed and removed files from a device associated with Naftali Bennett. The group posted a message addressed directly to Bennett, asserting that the compromise occurred despite his prior public statements on cybersecurity. No independent confirmation of the access method, timeline, or volume of data has been made public. The only detail released about the data itself is that internal files were taken.
Who is handala?
Handala is a ransomware and data-extortion group that has conducted operations against Israeli-linked targets in recent years. The group typically combines ransomware deployment with public leak-site postings to pressure victims. Its activity often includes both financial demands and statements framed around political grievances. Public reporting on the group’s prior incidents shows a pattern of targeting government figures, technology systems, and high-profile individuals, followed by selective disclosure of stolen material when negotiations stall.
About Operation Octopus: Naftali Bennett Listed by handala Ransomware Group
The listing appears under the name Operation Octopus and focuses on Naftali Bennett, a former prime minister of Israel with a public record of discussing national cybersecurity policy. Individuals in such positions routinely handle sensitive communications, policy documents, and personal administrative records on mobile devices. A claimed breach of this nature draws attention because it involves a former head of government whose devices may contain material not intended for public release.
What data was at risk
The only category named in the listing is internal files exfiltrated in a ransomware attack. No inventory of specific file types, dates, or contents has been published. Organisations and individuals in senior government roles commonly store correspondence, meeting notes, contact lists, and device backups; however, whether any of these categories were present in the claimed exfiltration remains unconfirmed.
The real-world impact
Exposure of internal files from a senior political figure can create secondary risks for associates, staff, and correspondents whose information appears in those records. Potential consequences include targeted phishing, reputational harm, or further attempts at extortion. For the individual concerned, the primary issues are loss of confidentiality and the need to secure or replace affected devices and accounts. No evidence of wider distribution of the material has been reported at this stage.
Were you affected?
Because the number of people impacted is unknown, anyone who corresponded with Bennett or his office in recent years should treat their contact details as potentially at risk. Practical first steps include changing passwords for any shared accounts, enabling multi-factor authentication, and monitoring for unusual login attempts. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public leaks.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
From Hunter to Hunted: Mossad’s Former Chief Falls into the Trap Listed by handala Ransomware GroupBehind the Curtain: Full Details of Shin Bet’s Iran Desk Officers Released Listed by handala Ransomware GroupMossad’s Secret Treasury Exposed: 50,000 Confidential Emails Leaked Listed by handala Ransomware GroupRaz Zimmt (head of the Iran Desk at Israeli security institutes) Listed by handala Ransomware GroupLatest breaches
Publicly posted by handala — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.