On February 9, 2025, the Iranian-aligned hacktivist group Handala announced it had breached the Israeli National Police network, claiming exfiltration of approximately 2.1 terabytes of sensitive law enforcement data. The group published what it described as 350,000 documents on its dark web leak site and BreachForums, making this one of the most significant claimed breaches of Israeli government infrastructure.
Alleged Scope of Compromise
According to Handala's posts, the exfiltrated data includes personnel files, weapons inventories, medical and psychological assessments of officers, legal case documentation, weapon permits, identity cards, email addresses, firearms licenses, photographs of officers, personal contact information, classified documents, and identification details regarding suspects and convicted criminals including information about sex offender employment permits.
This followed a series of escalating attacks in early 2025. In January, Handala compromised an emergency alert system operated by Maagar-Tec, triggering false terror alerts and air raid sirens in at least 20 kindergartens across Israel, causing widespread panic. In early February, the group leaked details of Israeli citizens holding licensed firearms.
Last Known Activity Before Disappearance
The police breach announcement on February 9 marked Handala's last verified public activity before a months-long disappearance. On the same day, the group shared a link to a new Telegram channel after its previous one was suspended. Nine days later, on February 18, cybersecurity firm OP Innovate published "Unpacking Handala," a detailed technical report exposing the group's infrastructure, attack methods, and operational behaviors.
Following the report's publication, Handala went silent until June 2025, when it resurfaced with attacks against the Delek Group and other Israeli targets coinciding with Israeli strikes on Iranian nuclear facilities. Whether the silence was caused by the infrastructure exposure, Telegram channel suspensions, or operational reorganization remains unclear.
Verification Challenges
As with many Handala claims, independent verification of the full scope is difficult. Multiple cybersecurity firms have noted the group's pattern of exaggerating capabilities and publishing partial, outdated, or recycled data to generate headlines. The International Institute for Counter-Terrorism documented at least 85 Handala attacks between February 2024 and February 2025 across healthcare, IT, education, and government sectors. Organizations should verify claimed breaches through forensic investigation rather than taking leak site posts at face value.