The 200,000 Message Bombshell: Bennett’s Game is Over Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 18, 2025, the handala ransomware group listed an incident on its leak site under the headline “The 200,000 Message Bombshell: Bennett’s Game is Over.” The listing references internal files exfiltrated in a ransomware attack and includes a direct message addressed to Naftali Bennett. No confirmed count of affected individuals or additional technical details has been released. The incident sits within a broader pattern of ransomware operations that combine encryption with data publication to pressure targets. Public reporting on the listing remains limited to the group’s own claims.

Breaking down the breach

The available facts state only that internal files were exfiltrated during a ransomware attack and that the group posted a listing on December 18, 2025. No information has been provided on the initial access method, the duration of the intrusion, or the volume of data taken. The number of people whose information may be involved is listed as unknown.

The group behind it: handala

Handala is a ransomware operator that maintains a public leak site to publish data from victims that do not meet its demands. The group’s listings typically include a mix of encrypted system files and selected internal documents. Its activity has been documented across multiple sectors in public threat reports, with operations that follow the common ransomware pattern of data theft followed by an extortion demand.

In this case the group claims responsibility through the leak-site posting. No independent confirmation of the underlying intrusion has been made public.

Who is The 200,000 Message Bombshell: Bennett’s Game is Over Listed by handala Ransomware Group?

The listing is framed around Naftali Bennett, a former prime minister of Israel. Political offices and senior public figures routinely maintain records of correspondence, scheduling data, and internal briefings. A breach affecting such material can expose communications that involve third parties who had no direct role in the targeted system.

The exact nature of the organisation or account referenced in the headline is not further described in the available facts.

The information in question

The listing identifies the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, message counts, or specific data categories has been released. Organisations that handle political or governmental correspondence typically retain emails, contact lists, and meeting records, yet the precise contents of the exfiltrated material remain unconfirmed.

Why it matters

Internal files from a political office can contain personal contact details, private correspondence, and operational information about individuals who interacted with the office. Exposure of such material creates privacy risks for those third parties even if they were not the primary target. For the organisation, the incident adds to the operational burden of incident response and potential follow-on scrutiny of its security controls.

What to do if you're exposed

Individuals who believe their information may be involved should monitor official statements from the affected office and any regulatory notifications that follow. Practical first steps include changing passwords for any accounts that may have been referenced in the files and enabling multi-factor authentication on email and messaging services.

• Review recent login activity on personal accounts.
• Watch for unsolicited messages that reference the incident.
• Run a free exposure scan of your email address against known breach data sets to check for prior appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.