Vahid Offline Members Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The reported listing of Vahid Offline Members by the handala group on March 17, 2026, centers on the possible exposure of contact details belonging to a large number of individuals. The group claims to have published a list of 180,000 Iranian members along with their mobile numbers. Because the exact number of people affected remains unknown and the contents of any exfiltrated files have not been independently verified, those whose information may be involved face uncertainty about how their data could be used.

Inside the incident

Public information about the event is limited to the group’s listing. The entry states that internal files were exfiltrated during a ransomware attack and that a member list with mobile numbers has been made available for download. No confirmation of the file contents, the method of access, or the scale of any encryption has been provided by the organization or by independent sources. The date the listing appeared is recorded as March 17, 2026.

The group behind it: handala

Handala is a ransomware operator that maintains a public leak site where it lists organizations it claims to have targeted. The group typically posts sample data or file listings to pressure victims. Its listings are presented as claims by the group itself; independent verification of each incident is not always available at the time of publication.

About Vahid Offline Members

Vahid Offline Members appears to operate as an online channel or community focused on Iranian users. Organizations of this type commonly maintain member directories that include contact information to facilitate communication among participants. A breach involving such a channel can affect individuals who joined expecting a limited, closed environment for their details.

The information in question

The listing describes internal files taken in a ransomware operation. The group further claims these include a roster of 180,000 members and associated mobile numbers. No additional categories of data have been specified in available reports, and the precise contents remain unconfirmed beyond the group’s statements.

What's at stake

Individuals whose mobile numbers appear in such a list may receive unsolicited contact or become targets for social-engineering attempts that reference their membership. The organization faces the operational consequence of having its internal records placed in a public forum, which can erode trust among participants who supplied their information on the assumption of restricted access.

If your data was in this claimed breach

Monitor incoming calls and messages for unusual patterns and consider using a secondary number for any future registrations. Review account security on services linked to the exposed mobile number. Readers can run a free exposure scan of their email address against known breach data to check for appearances in previously published sets.

AICompiled with AI assistance from public sources and published under our editorial standards.