Targets Locked: The Minds Behind Arrow and David’s Sling Are Revealed Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 13, 2025, the handala ransomware group listed an organization tied to the Arrow and David’s Sling defense systems on its leak site. The group claims to have exfiltrated internal files and published the names of 13 individuals described as principal architects of those systems, while offering a reward for further information. The number of individuals affected and the precise scope of any data exposure are not publicly confirmed. This listing occurs amid continued ransomware activity against entities handling sensitive technical and personnel records. Such incidents underscore the persistent risk to organizations that maintain detailed internal documentation on specialized projects.

What happened

The incident centers on a claim by the handala group that it conducted a ransomware operation against the listed target. Internal files were reportedly exfiltrated. No Reported Details on the date of the intrusion, the volume of data, or the method of initial access have been released. The group’s listing states that names of 13 individuals connected to the Arrow and David’s Sling programs were revealed.

Who is handala?

Handala, sometimes referenced in connection with RedWanted operations, is a ransomware group that has conducted data exfiltration and encryption attacks against various targets. Public reporting has associated the group with politically framed claims when disclosing stolen material. Its listings typically include assertions about the significance of the data and offers of rewards for additional details, though independent verification of those assertions varies by incident.

Targets Locked: The Minds Behind Arrow and David’s Sling Are Revealed Listed by handala Ransomware Group and its sector

The listed organization is connected to the development or oversight of the Arrow and David’s Sling missile defense systems. Entities in this sector routinely hold records on engineering personnel, technical specifications, project timelines, and contractor relationships. A breach involving such an organization can expose information that extends beyond technical data to include personal details of individuals working on restricted programs.

The information in question

The facts provided state that internal files were exfiltrated. No further breakdown of file categories or data fields has been confirmed. Organizations working on missile defense systems commonly maintain personnel files, design documentation, test records, and correspondence; however, the exact contents of the material referenced in this listing remain unconfirmed.

Why it matters

Exposure of internal files can create operational and personal risks for the organization and its staff. When names and roles of technical personnel become public, individuals may face increased scrutiny or targeting. For the organization, the loss of control over project-related material can affect ongoing work and relationships with partners, regardless of whether the data is later verified as authentic.

If your data was in this claimed breach

Monitor official statements from the affected organization for any guidance on next steps. Change passwords for any accounts that may have been linked to the organization and enable multi-factor authentication where available.

• Review recent account activity for signs of unauthorized access.
• Consider a credit freeze if financial or identity-related details could be involved.
• Run a free exposure scan of your email address against known breach datasets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.