Tosaf Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and manufacturing firms as a way to disrupt operations and pressure organisations into negotiations, often by combining system encryption with claims of data theft. In this environment, listings on leak sites have become a common tactic, even when independent verification remains limited.

On 2 February 2025, the group known as handala publicly listed Tosaf, asserting that it had breached the company’s systems, exfiltrated internal files, and imposed a lockdown. The number of people affected is unknown, and public detail beyond the group’s own statements is limited. The incident matters because industrial firms of this scale typically hold operational, employee and commercial data whose exposure can create lasting practical risks.

Inside the incident

According to the listing attributed to handala, the group claimed on 2 February 2025 that it had “successfully breached and taken full control of the systems at Tosaf,” describing the company as one of the largest industrial organisations linked to Israel, with more than 5,000 employees and 60 offices worldwide. The group further stated that it had initiated a full lockdown of all entry points to the facility early that morning, preventing workers from entering. The only data category named in available reporting is “internal files exfiltrated in a ransomware attack.” No independent confirmation of the intrusion, the lockdown claim, the volume of data taken, or the precise timeline has been provided in the public record. The number of individuals affected remains unknown, and the method of initial access has not been disclosed.

Who is handala?

Handala is a publicly documented threat actor that has operated under a political banner, frequently claiming attacks against Israeli-linked or Western-aligned organisations. The group is known for combining ransomware-style encryption claims with data-exfiltration announcements posted on leak sites, often accompanied by ideological statements. Its typical pattern involves asserting full system control, publishing partial evidence or screenshots, and threatening further releases unless demands are met. Prior activity attributed to the group has focused on industrial, governmental and commercial targets, using the publicity of leak-site listings to amplify pressure. In this case, the listing of Tosaf is treated as an unverified claim by the group; no confirmation from the organisation or independent investigators is contained in the available facts.

Tosaf and its sector

Tosaf is an industrial manufacturer operating in the plastics and masterbatch sector, producing colour and additive compounds used across packaging, automotive, construction and consumer-goods supply chains. Companies of this type maintain global production and distribution networks; the group’s own description places Tosaf at more than 5,000 employees and roughly 60 offices. Organisations in this sector routinely hold proprietary formulations, production schedules, supplier contracts, employee records, customer lists and logistics data. A breach at such a firm is consequential because disruption can affect manufacturing continuity, and any compromise of internal files can expose both commercial secrets and personal information of staff and partners. The listing therefore raises questions about operational resilience and data-handling practices common to large industrial enterprises, without establishing negligence as fact.

The information in question

The only category of data named in the available facts is “internal files exfiltrated in a ransomware attack.” Exact contents, file counts, or categories such as personal identifiers, financial records or intellectual property have not been disclosed. Organisations of Tosaf’s type typically store employee personnel files, payroll and contact details, customer and supplier contracts, technical specifications, quality-control records and internal communications. Because the precise material taken remains unconfirmed, it is not possible to state which of these, if any, were involved. Readers should treat any subsequent claims of specific data sets as unverified until corroborated by the organisation or independent analysis.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include targeted phishing, identity misuse or social-engineering attempts that reference genuine workplace details. Employees and contractors could face credential-stuffing attacks if login data or contact lists were included. For the organisation, the stakes centre on potential operational interruption, loss of proprietary process knowledge, and the longer-term cost of forensic investigation, system restoration and customer or partner notification. Even when encryption claims cannot be independently verified, the mere assertion of exfiltration can erode trust among suppliers and clients who rely on the integrity of shared commercial data. Because the scale of impact is unknown, both personal vigilance and organisational transparency remain the primary mitigations.

If your data was in this claimed breach

If you have a past or present connection to Tosaf—as an employee, contractor, supplier or customer—consider the following practical steps:

• Monitor financial and email accounts for unexpected activity and enable multi-factor authentication wherever available.
• Treat unsolicited messages that reference Tosaf or industrial projects with caution; verify any request for credentials or payments through a known official channel.
• Change passwords on work-related and personal accounts that may have been reused, and review recent login alerts.
• Request a free exposure scan of your email address to check whether it has already appeared in other known breach data sets.
• Retain any official notifications from Tosaf and follow guidance issued by the company or relevant data-protection authorities once they become available.

Public detail on this incident remains limited to the group’s claims and the basic facts reported on 2 February 2025. Continued monitoring of statements from Tosaf itself will be necessary for a clearer picture of what, if anything, was taken and who may be affected.

AICompiled with AI assistance from public sources and published under our editorial standards.