Smile for the Camera – Handala Is Watching Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 15, 2025, the handala ransomware group listed Shabak as a target and stated that internal files had been exfiltrated during a ransomware operation. The number of people affected is not known, and no independent confirmation of the claimed access or data volume has been made public. The incident is described only through the group’s listing and accompanying statement. No date of intrusion, method of entry, or quantity of material has been disclosed by Shabak or by investigators. The group’s announcement refers to airport security systems but provides no technical details or evidence that can be verified from outside sources.

Breaking down the breach

The only confirmed public record is the November 15 listing itself. It states that internal files were taken; nothing further about the scope, encryption status, or subsequent use of the material has been released. Timing of the intrusion, the precise systems involved, and any ransom demand remain undisclosed.

The group behind it: handala

Handala is a ransomware operator that has previously published claims against government and commercial targets. Its listings typically include a short statement and a sample of files. In this case the group asserts responsibility for the Shabak operation and frames the action in political terms, but those assertions have not been corroborated by third-party evidence or by the victim organisation.

Who is Shabak?

Shabak, also known as the Israel Security Agency, is the country’s internal security service. Its responsibilities include counter-terrorism, counter-espionage, and protective security at airports and other sensitive sites. Organisations of this type routinely hold operational records, personnel files, and technical documentation related to security procedures.

The information in question

The listing refers to “internal files exfiltrated in ransomware attack.” No inventory of file types, no indication of personal data, and no confirmation of encryption or deletion have been published. Typical holdings of an internal security agency would include investigative materials, communications, and administrative records, but the exact contents in this instance are unconfirmed.

What's at stake

Exposure of internal operational files could reveal investigative methods or contacts, potentially complicating ongoing work. Individuals named in those files could face identification risks even if the material is not widely circulated. For the organisation, the incident adds to the operational burden of verifying the claim and securing affected systems.

Were you affected?

Because the number of individuals involved is unknown, anyone who has interacted with Shabak or passed through its security processes should treat the situation as unconfirmed. Practical steps include monitoring official statements from the agency, changing passwords for any related accounts, and enabling multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.