Shelter Locations in Israel Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 23, 2025, the organization known as Shelter Locations in Israel appeared on a listing by the handala ransomware group. Public reporting indicates that the group claims to have exfiltrated internal files in a ransomware attack and asserts that the list of Israeli shelters has been exposed, stating that every location is now known. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

The incident matters because shelter location data underpins civil-defense planning in a region where such facilities serve as critical public infrastructure. Any unauthorized disclosure of that information carries potential consequences for operational security and public safety, even while many technical details stay undisclosed.

Inside the incident

According to the available record, Shelter Locations in Israel was listed by handala on June 23, 2025. The group claims that internal files were exfiltrated during a ransomware attack and that the list of Israeli shelters has been exposed. Its accompanying statement asserts that every location is now known, that hiding is no longer an option, and that the land will not protect those who built over its wounds; it further addresses a message to Sara Netanyahu following the claimed exposure. The statement frames the disclosure as a fact rather than a threat and urges departure for survival.

No verified count of affected individuals has been published. The precise method of initial access, the volume of data taken, the exact date of intrusion, and whether any ransom demand was issued or paid remain undisclosed in the public facts. What is known is limited to the listing itself and the group’s claim that internal files containing shelter-location information were removed and made known.

Inside handala

Handala is a publicly documented threat actor that has operated under a ransomware and hacktivist model, frequently directing activity against Israeli organizations and entities perceived as linked to Israeli interests. The group typically publicizes its operations by posting victim names and sample data or statements on leak sites, often combining technical claims of data theft with political messaging. Prior activity associated with the name has included assertions of network compromise, file exfiltration, and calls for public attention to the claimed disclosures.

In this case the listing of Shelter Locations in Israel is presented by the group as evidence of a successful ransomware attack that resulted in the removal of internal files. No independent verification of those technical claims is contained in the available facts; the statements about shelter lists and the accompanying political language should therefore be treated as the group’s own assertions rather than confirmed findings.

About Shelter Locations in Israel

Shelter Locations in Israel refers to an entity or dataset concerned with the geographic and operational details of civilian shelters across the country. In Israel, shelters form a core component of civil-defense infrastructure, designed to provide rapid protection during rocket or missile attacks. Organizations that maintain or publish such location data typically hold maps, addresses, capacity figures, access instructions, and related planning documents used by municipalities, emergency services, and the public.

A breach involving this category of information is consequential because accurate shelter data is both a public-safety resource and a potential operational vulnerability. Knowledge of precise locations, capacities, or access routes could, if misused, affect the effectiveness of protective measures. At the same time, the organization itself may hold administrative records, contact details, or internal correspondence that, if exposed, would compound the sensitivity of the geographic data.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack and that the group claims the list of Israeli shelters has been exposed. Beyond that description, specific data types, file names, record counts, or sample contents are not disclosed. Organizations responsible for shelter information commonly maintain location coordinates or addresses, facility capacities, operational status, maintenance records, and sometimes associated personnel or municipal contact data. Whether any of those categories were present in the claimed files, and in what volume or format, remains unconfirmed.

Readers should therefore treat the precise contents as unknown. The only concrete assertion available is the group’s claim that shelter-location lists formed part of the material taken and publicized.

The real-world impact

If shelter-location data has in fact been made public, the immediate risk is the loss of any operational secrecy that previously attached to those sites. Adversaries or opportunistic actors could use the information to map protective infrastructure, potentially complicating emergency planning or public messaging. Individuals who rely on specific shelters may face uncertainty about whether their usual locations remain secure or whether access patterns have been altered by the disclosure.

For the organization, the incident creates administrative and reputational burdens: verifying what was taken, notifying relevant authorities, assessing residual risk to remaining systems, and coordinating with civil-defense partners. Because the number of affected people is unknown, the scale of any personal-data exposure—if personal data were present at all—cannot yet be quantified. The broader effect is an erosion of confidence in the confidentiality of critical infrastructure records, even while many technical particulars stay unconfirmed.

Were you affected?

If you have any connection to Shelter Locations in Israel—whether as staff, a municipal partner, or a member of the public whose contact details may have been stored—consider basic protective steps. Change passwords on any related accounts, enable multi-factor authentication where available, and monitor for unusual communications that reference shelter data or the incident. Because the exact data set remains unconfirmed, treat unsolicited messages claiming to contain leaked files with caution.

You can also run a free exposure scan of your email address to check whether it has appeared in previously known breach data sets. Such a scan will not confirm involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritize further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.