Tamir Hayman Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 13, 2026, the handala ransomware group listed Tamir Hayman on its leak site and claimed to have obtained internal files from a ransomware operation. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public. The incident reflects a pattern in which ransomware operators target individuals in sensitive national-security roles and use public listings to draw attention to their claims.

Breaking down the breach

The only confirmed public record is the March 13, 2026 listing by handala. The group stated that internal files had been exfiltrated and referenced correspondence belonging to Hayman. No verified count of records, timeline of the intrusion, or technical details of the attack method have been disclosed by the organization or by investigators.

Who is handala?

Handala is a ransomware group that has conducted operations against targets in Israel and elsewhere. Like other ransomware actors, it typically combines encryption of systems with the threat of publishing stolen data on a dedicated leak site. The group’s listing of Tamir Hayman constitutes its claim of responsibility; independent verification of that claim has not been reported.

Who is Tamir Hayman?

Tamir Hayman is the former chief of Aman, Israel’s military intelligence directorate, and currently serves as executive director of Israel’s national security institutes. Organizations in this sector routinely handle internal correspondence, policy documents, and contact information related to defense and intelligence matters. A claimed compromise of such material therefore draws attention because of the nature of the work rather than any confirmed scale of exposure.

What was likely exposed

The listing describes internal files obtained through a ransomware attack. The group’s statement references email correspondence, but the precise categories and volume of data remain unconfirmed. Entities of this type commonly maintain records such as professional communications, meeting notes, and administrative files; whether any of those categories were actually taken has not been established beyond the group’s assertion.

What's at stake

For individuals whose information appears in the claimed material, the primary risks are targeted phishing, social-engineering attempts, or reputational exposure. For the organization, the incident underscores the difficulty of protecting high-value personal mailboxes even when formal security structures are in place. No evidence of subsequent misuse of specific records has been reported to date.

If your data was in this claimed breach

Because the number of affected individuals is unknown, anyone who corresponded with Hayman or his office should treat the possibility of exposure seriously.

• Change passwords for any email accounts that may have been involved and enable multi-factor authentication.
• Monitor incoming messages for unusual requests that reference past correspondence.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.