Handala hack-and-leak claims against Israeli targets
Alleged: Reported or claimed; not established in the public record.
A persona called Handala claimed in February 2025 to hold 2.1TB (350,000 files) from Israeli police, and in December 2025 to have breached Telegram accounts of senior officials. Researchers who checked the December claim found it overstated.
Confirmed
Israeli police denied a direct penetration of their systems. KELA found that only Telegram accounts were compromised, that most released "chats" were empty contact cards, and that about 40 held real messages.
Claimed, disputed or not established
The volumes claimed are the persona's own. Reports link such personas to Iran, but the sources opened give researchers' assessments, not official findings. We keep the individuals generic.
Reported impact
Propaganda value out of proportion to the proven data theft, on the researchers' reading.
Source strength: Hackread is a trade outlet and KELA is a vendor that also sells threat intelligence.
Sources (opened in a new tab)
- Hackread: Handala hackers claim Israeli police breach ↗https://hackread.com/handala-hackers-israeli-police-breach-data-leak/
- KELA: the Handala hack of Telegram accounts ↗https://www.kelacyber.com/blog/handala-hack-telegram-breach-israeli-officials/
Connected
- Related leaks: Lab Dookhtegan: leaks on Iran's APT34 / OilRig
- Case board · Timeline (2025) · Document vault · How we verify leaks
This page describes and cites public reporting. It does not host or link to leaked files, and it names no private individuals.