Propaganda Chief and Former Mossad Deputy Exposed by Handala Hack Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The claim centers on an asserted breach of an email account belonging to Deborah Oppenheimer, identified as the former Deputy Head of Foreign Relations and Cooperation at Mossad and current Head of International Affairs at Israel’s National Security Institute. The incident was reported on March 20, 2026, with the handala group stating that internal files were exfiltrated. The number of people affected remains unknown, and no independent confirmation of the data release or its scope has been established.

Inside the incident

The reported event involves the handala group listing the target and claiming access to Oppenheimer’s email account. The only detail provided is that internal files were taken during what the group describes as a ransomware attack. No timeline for the intrusion, volume of data, or method of access has been disclosed. The listing itself constitutes the group’s assertion; no further verification of the material or its distribution has been made public.

The group behind it: handala

Handala is a publicly documented threat actor that has conducted operations against Israeli-linked targets. The group typically announces intrusions on its leak sites and frames them in political terms. Its activity pattern includes claims of data exfiltration from government, security, and institutional accounts, sometimes accompanied by ransomware-style demands even when the primary objective appears to be disclosure. Any specific statements the group makes about a given victim remain claims until corroborated by other evidence.

Propaganda Chief and Former Mossad Deputy Exposed by Handala Hack Listed by handala Ransomware Group and its sector

The listed target is tied to Israel’s National Security Institute, an organization that conducts research and coordination on national security matters. Individuals in senior roles at such institutes routinely handle correspondence with foreign counterparts, policy documents, and internal assessments. A breach affecting an account used for these functions raises questions about the handling of institutional communications, though the precise nature of any material obtained has not been confirmed beyond the group’s general reference to internal files.

The information in question

The only data category stated is internal files exfiltrated in a ransomware attack. No inventory of file types, no count of records, and no confirmation of personal identifiers or classified content have been released. Organizations of this type commonly store meeting records, research papers, contact lists, and administrative correspondence; however, whether any such material was actually taken remains unconfirmed.

Why it matters

Exposure of internal files from a national security institute can affect ongoing institutional relationships and research activities. For individuals whose information appears in those files, the primary concerns are potential misuse of contact details or professional context. Because the scale and contents are undisclosed, the concrete impact on any specific person cannot yet be assessed.

Were you affected?

Individuals who have corresponded with the National Security Institute or similar bodies can monitor official statements from the organization for any further disclosure. A practical first step is to review recent email activity for anomalies and to change passwords for accounts that may share credentials. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in published leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.