Raz Zimmt’s Chats Leaked to the World Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 6, 2026, the handala ransomware group listed material it claims to have obtained from Raz Zimmt on its leak site. Raz Zimmt is identified in the listing as Head of the Iran Desk at the Israeli National Security Institute. The number of individuals affected is not stated, and the precise contents of any released material remain limited to the group’s public claim of internal files. The incident adds to the pattern of ransomware operators publishing data they assert was taken from organisations or individuals connected to national-security work.

Breaking down the breach

The reported incident centres on a listing posted by the handala group on April 6, 2026. The listing states that internal files were exfiltrated during a ransomware operation. No figure for the volume of data, the number of individuals impacted, or the technical method of intrusion is provided in the available information. The group’s accompanying message claims the material includes WhatsApp and X conversations belonging to Raz Zimmt and references prior warnings directed at him.

The group behind it: handala

The handala ransomware group is the entity that posted the listing. The group claims responsibility for the exfiltration and states that the material now appears on its leak site. No independent confirmation of the data’s authenticity or completeness has been reported. Public records of the group’s activity show it has previously used similar leak-site postings to pressure targeted organisations.

Raz Zimmt’s Chats Leaked to the World Listed by handala Ransomware Group and its sector

The affected party is listed under the name Raz Zimmt’s Chats Leaked to the World Listed by handala Ransomware Group. Raz Zimmt holds the position of Head of the Iran Desk at the Israeli National Security Institute. Organisations in this sector routinely handle research, analysis, and communications related to regional security matters. A breach involving such an individual can expose internal correspondence that extends beyond the person directly named.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. The group’s listing claims these files include WhatsApp and X chats. No verified inventory of specific data categories, file counts, or time periods covered has been released. Organisations of this type commonly retain internal reports, contact lists, and professional communications; however, the exact contents in this case remain unconfirmed beyond the group’s assertion.

Why it matters

Exposure of internal files from a national-security research role can reveal working methods, contact networks, and analytical material that was intended to remain restricted. Individuals whose information appears in such files may face follow-on risks such as targeted phishing or social-engineering attempts. For the organisation, the incident underscores the difficulty of containing data once it has left controlled systems, regardless of the initial cause of the intrusion.

If your data was in this claimed breach

Individuals who believe their information may have been included should change passwords for any accounts referenced in the exposed material and enable multi-factor authentication where available. Monitoring email and messaging accounts for unusual activity is a prudent first step. Readers can run a free exposure scan of their email address against known breach data sets to check for prior appearances in public leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.