Raz Zimmt (head of the Iran Desk at Israeli security institutes) Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 12, 2026, the handala Ransomware Group listed Raz Zimmt, identified as head of the Iran Desk at Israeli security institutes, on its leak site. The group claims responsibility for a ransomware incident involving the exfiltration of internal files. The number of individuals whose information may be involved remains unknown, and no further technical details about the intrusion have been released publicly. The incident highlights the exposure risks that accompany data held by individuals in security research roles, where professional correspondence and internal records can contain sensitive details with wider implications for personal privacy and operational security.

Inside the incident

The listing appeared on March 12, 2026. The group states that internal files were taken during a ransomware operation. No information has been provided on the timing of the access, the volume of data removed, or the methods used to gain entry. The exact scope of any encryption or additional demands also remains undisclosed.

Who is handala?

Handala is a ransomware group that publishes victim names and sample data on dedicated leak sites when ransom negotiations fail or as part of its operations. The group has previously targeted organisations across multiple sectors and uses these sites to assert claims of access. Its listings function as public statements rather than independently verified incidents.

Who is Raz Zimmt (head of the Iran Desk at Israeli security institutes) Listed by handala Ransomware Group?

Raz Zimmt is publicly identified with research and analysis roles focused on Iran within Israeli security-related institutes. Organisations of this type routinely collect and store intelligence assessments, contact records, and internal communications. A claimed breach at such an entity draws attention because the material involved often intersects with national-security topics and personal networks of researchers and officials.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. The precise categories of information contained in those files have not been confirmed. Organisations handling Iran-related security research typically maintain records that include professional correspondence, analytical documents, and contact information, yet the actual contents of the claimed exfiltration remain unverified.

Why it matters

Individuals whose details appear in such files face the possibility that personal or professional information could be further distributed or misused. For the organisation, the incident raises questions about the protection of research materials that may affect ongoing work and the privacy of associated contacts. Without confirmed data inventories, the full extent of downstream effects cannot be assessed.

Were you affected?

Anyone concerned about possible exposure should review their own email accounts and professional contacts for unusual activity and consider changing passwords for any linked services. Public breach-notification resources and credit-monitoring options can provide additional checks where available.

• Search known breach databases with your email address.
• Enable multi-factor authentication on accounts that may be referenced in professional correspondence.
• Monitor for unsolicited messages that reference the incident or request verification.
• Contact the relevant institute directly if you hold an official affiliation and require guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.