Zerto Security Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In a threat landscape where ransomware groups and hacktivist actors routinely list corporate victims on leak sites to pressure organisations and publicise claims, a new entry appeared on 23 June 2024. The handala group listed Zerto Security, asserting that it had conducted a ransomware attack and exfiltrated internal files. Public detail remains limited: the number of people affected is unknown, and no independent confirmation of the claim has been provided in the available record. The incident matters because Zerto operates in the cybersecurity and data-protection sector, where any compromise of internal material can raise questions about operational security and the potential exposure of sensitive business information.

What is known comes solely from the group's listing and the contemporaneous reporting of that claim. Readers should treat the listing as an unverified assertion until further evidence emerges. The following account stays strictly within those bounds while placing the event in context for people who may be concerned about their own data.

Breaking down the breach

According to the reported summary, handala claimed on or around 23 June 2024 that it had “hacked Zerto,” describing the organisation as one of the largest Zionist cyber-security companies in the world and stating that internal files had been exfiltrated in a ransomware attack. The listing characterises Zerto as a Hewlett Packard Enterprise company whose platform simplifies the protection, recovery and mobility of on-premises and cloud applications. No further technical details—such as the initial access vector, the specific ransomware variant, the volume of data taken, or the precise date of intrusion—have been disclosed in the public record of this incident. The number of individuals whose information may have been involved is listed as unknown. Because the only source is the group’s own claim on its leak site, the scale, success and full scope of any intrusion remain unconfirmed.

The group behind it: handala

Handala is a publicly documented threat actor that has operated for several years with a stated pro-Palestinian political orientation. The group typically combines data-theft claims with leak-site postings, often framing its actions as retaliation against organisations it associates with Israeli or Western interests. Its tactics have included ransomware-style encryption demands alongside pure data-exfiltration and public dumping of files. Prior activity attributed to handala has targeted a range of commercial, governmental and technology entities; the group frequently amplifies its listings with political messaging. In this case the facts record only that handala listed Zerto Security and claimed a successful ransomware attack with internal-file exfiltration. No additional statements by the group about this specific victim—beyond the characterisation quoted above—are part of the provided record, and the listing itself should be read as a claim rather than established fact.

About Zerto Security

Zerto is a data-protection and disaster-recovery technology company that became part of Hewlett Packard Enterprise. Its platform is designed to keep business applications available by simplifying backup, recovery and mobility across on-premises and cloud environments. Organisations of this type typically handle technical documentation, customer-support records, internal operational data, source-code repositories or configuration materials, and employee information necessary to run a global software business. Because Zerto’s products sit inside customers’ resilience architectures, any reported compromise of its own internal systems draws attention: customers and partners may worry about secondary exposure of their own environments or about the integrity of the tools they rely on. The available facts do not assert that any customer systems were affected; they simply record the group’s claim against Zerto itself.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” No inventory of file types, no sample documents, and no confirmation of personal data, credentials or source code have been published in the record used for this article. Organisations in the cybersecurity and data-management sector commonly store engineering documents, internal communications, customer contracts, support tickets and employee records. Whether any of those categories were among the material handala claims to hold is unconfirmed. Until a verified disclosure or forensic report appears, the precise contents remain unknown, and any assertion of specific data types beyond the phrase “internal files” would be speculation.

What's at stake

For individuals, the principal risk is that personal or professional contact details, if present in the exfiltrated material, could later appear in secondary dumps or be used for phishing. Because the number of people affected is unknown and the data types are not itemised, the concrete exposure for any given person cannot yet be quantified. For Zerto and its parent company the stakes include potential operational disruption, reputational damage among customers who depend on the firm’s resilience products, and the cost of investigation and remediation. In the wider market, a claimed breach at a data-protection vendor can prompt customers to re-examine their own backup and recovery postures—an outcome that is useful regardless of whether the original claim is fully substantiated. No financial figures, ransom demands or confirmed customer impacts are part of the public facts for this incident.

Were you affected?

If you are a current or former employee, contractor or customer of Zerto, treat the listing as a prompt for ordinary vigilance rather than confirmed personal compromise. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where it is not already in place, and be alert to phishing messages that reference the company or the incident. Because the exact data set is undisclosed, there is no public list of affected individuals against which to check. You can, however, run a free exposure scan of your email address against known breach corpora to see whether your information has already surfaced in other incidents. If you receive notification directly from Zerto or Hewlett Packard Enterprise, follow the guidance in that communication. Public detail on this event remains limited; further verified information, if it emerges, will clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.