Shock for Israeli Intelligence: 100,000 Classified Emails of Mossad’s Ex-Deputy Director S... Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The reported incident involves the claimed compromise of the personal email account of Sima Shine, a former Mossad Deputy Director for Research and Head of the Iran Desk who now leads a sensitive Israeli intelligence body. On March 16, 2026, the handala ransomware group listed more than 100,000 of her emails on its leak site, describing them as ultra-classified internal files obtained through a ransomware operation. Public detail on the number of people affected remains unknown, and the precise scope of any confirmed exfiltration has not been independently verified.

Breaking down the breach

The facts state that the group claims to have exfiltrated internal files during a ransomware attack targeting Shine’s personal email. The listing appeared on March 16, 2026, and references over 100,000 emails. No additional technical details on the initial access method, encryption status, or ransom demands have been disclosed in available reporting. The number of individuals whose information may be involved is not stated.

The group behind it: handala

Handala is a ransomware operator that maintains a leak site to publish data it claims to have stolen from victims. Public records show the group typically combines encryption of systems with the threat of data release to pressure targets. It has appeared in prior incidents involving both commercial and governmental entities, following a pattern of posting sample files to establish credibility for its claims.

Shock for Israeli Intelligence: 100,000 Classified Emails of Mossad’s Ex-Deputy Director S... Listed by handala Ransomware Group and its sector

Mossad is Israel’s primary foreign intelligence service, responsible for collection, counter-terrorism, and analysis of threats abroad. Senior officials in such agencies routinely handle correspondence that includes assessments of foreign governments, operational planning references, and liaison communications with other services. A breach affecting an individual who has held multiple senior roles therefore touches material that intelligence organisations treat as sensitive by default.

The information in question

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No further inventory of specific email contents, attachments, or classification markings has been released. Organisations of this type commonly retain policy documents, meeting notes, and analytical products; however, the exact composition of the listed material remains unconfirmed beyond the group’s claim.

Why it matters

Exposure of correspondence belonging to a former senior intelligence official can reveal patterns of contact, institutional priorities, and working methods even when individual messages appear routine. For the organisation, such an incident underscores the difficulty of separating personal and professional communications when high-ranking staff use private accounts for any portion of their work.

If your data was in this claimed breach

Individuals concerned about possible exposure should first verify whether their own email addresses appear in known public breach repositories. Practical steps include changing passwords for any accounts that may have been reused, enabling multi-factor authentication, and monitoring for unusual login attempts. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.

• Change passwords on affected and related accounts.
• Enable multi-factor authentication everywhere it is available.
• Review recent login activity for signs of unauthorised access.
• Monitor official statements from the affected organisation for further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.