TBN Israel Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware and hacktivist groups continue to target media and faith-linked organisations as part of a wider pattern of ideologically motivated cyber operations. Listings on leak sites have become a common way for such actors to claim success, often before any independent confirmation of the scale or contents of a breach. Against that backdrop, TBN Israel was named on 16 June 2025 by the group known as handala.

Public reporting states that handala listed TBN Israel after claiming a ransomware attack in which internal files were exfiltrated. The number of people affected remains unknown, and independent verification of the full scope has not been published. The listing itself constitutes an unverified claim by the group.

Inside the incident

According to the available record, handala reported on 16 June 2025 that it had successfully infiltrated and compromised internal systems belonging to TBN Israel. The group stated that the operation involved a ransomware attack and the exfiltration of internal files. No further technical details—such as the initial access method, the specific ransomware variant, the duration of access, or the volume of data taken—have been disclosed in the public summary.

The number of individuals whose information may have been involved is listed as unknown. The group’s own description characterises TBN Israel as a media organisation operating under the guise of religious broadcasting and asserts that documents and communications obtained in the breach reveal ties to Israeli intelligence operations. These characterisations and the claimed contents of the files are presented solely as statements by handala; they have not been independently confirmed in the facts available.

Who is handala?

Handala is a publicly documented threat actor that has repeatedly claimed responsibility for cyber operations against Israeli and Israel-linked organisations. The group typically combines data theft with ransomware tactics and publishes victim names on leak sites, often framing its activity in political or ideological terms rather than purely financial ones. Prior public activity has included claims against government, commercial and media targets, with the group frequently asserting that stolen material will be released to expose alleged wrongdoing.

In this case, handala’s listing of TBN Israel follows the same pattern: a public claim of infiltration, exfiltration of internal files, and a narrative that the victim is more than a religious broadcaster. No confirmation that the group’s specific assertions about TBN Israel’s operations or intelligence ties are accurate appears in the available facts. The listing should therefore be treated as an unverified claim pending further evidence.

About TBN Israel

TBN Israel is the Israeli arm of a Christian media network that produces and distributes religious programming. Organisations of this type typically maintain viewer and donor databases, internal correspondence, production materials, financial records and staff information. Because they operate at the intersection of media, faith communities and, in some cases, public advocacy, they can hold both personal data and sensitive operational documents.

A breach affecting such an organisation is consequential for two reasons. First, any compromise of internal systems can expose personal details of employees, partners or supporters. Second, the public nature of a leak-site listing can amplify reputational and operational pressure even when the precise contents of the stolen data remain unconfirmed. The facts do not establish negligence or specific security failures on the part of TBN Israel; they record only that the organisation was named by handala.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. Exact file names, categories or volumes have not been disclosed. Organisations engaged in religious broadcasting commonly hold the following categories of information, any of which could theoretically have been present on compromised systems:

• Staff and contractor records, including contact details and employment documents
• Viewer, donor or subscriber lists and related correspondence
• Internal emails, planning documents and production materials
• Financial and administrative records

Because the public record does not itemise the stolen material beyond “internal files,” it is not possible to confirm which of these, if any, were actually taken. Readers should treat any specific claims about the contents as unconfirmed until corroborated by the organisation or independent investigators.

Why it matters

For individuals whose data may have been among the internal files, the primary risks are identity misuse, targeted phishing, and unwanted contact. Even limited personal details can be combined with other publicly available information to craft convincing social-engineering attempts. For the organisation, the incident creates operational disruption, potential regulatory scrutiny, and the need to communicate with staff and partners while the full extent of the exfiltration remains unclear.

Because the number of affected people is unknown and the precise data types are not itemised, the practical impact cannot yet be quantified. The listing by handala nevertheless places TBN Israel in a public spotlight that may encourage further scrutiny of its systems and relationships. Calm, evidence-based follow-up by the organisation and by any individuals who believe they may be involved remains the most useful response.

Were you affected?

If you have had dealings with TBN Israel—whether as staff, partner, donor or viewer—consider the following practical steps. Monitor financial and email accounts for unusual activity. Be cautious of unsolicited messages that reference the organisation or claim to have inside information. Change passwords on any accounts that may have used the same credentials as those associated with TBN Israel services. Where available, enable multi-factor authentication.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Such a scan does not prove or disprove involvement in this specific incident, but it can indicate whether your details have surfaced elsewhere and help you prioritise further protective measures. Public detail on this claimed breach remains limited; further official statements from TBN Israel or independent researchers will be needed before a fuller picture emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.