Sheba Medical Center Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare providers have become frequent targets for ransomware groups that seek both financial gain and publicity by disrupting critical services and threatening to release sensitive records. Against that backdrop, the listing of Sheba Medical Center by the group known as handala on 15 July 2024 drew attention because the organisation is a major hospital whose systems hold clinical and administrative data. Public detail remains limited; what is known rests largely on the group’s own claims rather than independent confirmation of scale or method.

The incident matters because any compromise of hospital systems can affect patient care, staff operations and the confidentiality of medical information. At the same time, the absence of verified figures for affected individuals or confirmed data categories means the full extent of exposure is still unconfirmed.

What happened

On 15 July 2024 Sheba Medical Center was listed by the handala ransomware group. According to the group’s own statement, internal files were exfiltrated during a ransomware attack. The listing describes the centre as the largest hospital in the “Occupied lands” and claims it ranks among the world’s top hospitals. Handala further asserted that it “destroyed the heart department” while choosing not to target every part of the facility. No independent confirmation of these operational claims has been made public, and the number of people affected remains unknown. Timing of the intrusion, the precise technical method used, and the volume of data taken have not been disclosed beyond the group’s leak-site entry.

Inside handala

Handala is a pro-Palestinian threat actor that has publicly claimed responsibility for multiple cyber operations against Israeli organisations. The group typically operates by gaining access to networks, exfiltrating data and then publishing or threatening to publish that material on a leak site while demanding ransom. Its statements frequently mix technical claims with political messaging. Prior activity attributed to the group has included attacks on government, commercial and critical-infrastructure targets, often accompanied by screenshots or sample files intended to prove access. In the present case the only specific assertions about Sheba Medical Center come from handala’s own listing; those assertions should be treated as unverified claims rather than established fact.

Who is Sheba Medical Center?

Sheba Medical Center, also known as Chaim Sheba Medical Center, is Israel’s largest hospital and a major academic medical centre. Institutions of this type routinely manage electronic health records, diagnostic images, laboratory results, appointment systems, billing data and staff credentials. They also operate specialised departments whose continuous functioning is essential for acute care. A ransomware incident at such a facility therefore carries consequences that extend beyond data confidentiality to the availability of clinical services. Public reporting has long ranked Sheba among leading hospitals internationally, which is the context in which handala framed its claim.

The information in question

The only data category named in available reporting is “internal files exfiltrated in a ransomware attack.” No further breakdown—such as patient names, medical histories, financial records or staff details—has been confirmed. Organisations of this kind typically hold extensive personal and clinical information, yet the exact contents of any files allegedly taken from Sheba remain unconfirmed. Readers should therefore treat any more granular descriptions circulating online as speculative until corroborated by the hospital or independent investigators.

The real-world impact

For individuals, the primary risks associated with hospital data exposure include identity theft, medical fraud and unwanted contact based on sensitive health details. Even when specific records are not publicly verified, the mere possibility of clinical data circulating can create lasting anxiety and require monitoring of credit and medical accounts. For the organisation, operational disruption—whether temporary system outages or the need to rebuild affected departments—can delay care and divert resources. Reputation and regulatory scrutiny often follow, regardless of whether negligence is ever established. Because the number of people affected is unknown and the precise data types unconfirmed, the concrete impact on any given patient or staff member cannot yet be quantified.

Were you affected?

If you have been a patient, visitor or employee of Sheba Medical Center, treat the incident as a prompt for ordinary caution rather than panic. Monitor financial statements and medical billing for unexpected activity, enable multi-factor authentication on any accounts that reuse hospital-related email addresses, and consider placing a fraud alert with credit bureaus if you believe highly sensitive identifiers may have been involved. You can also run a free exposure scan of your email address against known breach data sets to check whether that address has already appeared in public dumps. Official updates, if any, will come from the hospital itself; until then, rely on verified sources and avoid sharing personal details with unsolicited callers claiming to assist with the breach.

AICompiled with AI assistance from public sources and published under our editorial standards.