Handala 2026 activity
State-aligned group. 5 reports in 4 countries: 1 confirmed, 4 claimed or disputed. Latest 13 Apr 2026.
United Arab Emirates · 
Ireland · 
Saudi Arabia · 
Israel
🎯 What sources say
- Israel: Claimed the Clalit Health Services breach and leaks of former officials' data in 2026. The FBI has linked the persona to Iranian intelligence. Times of Israel Insurance Journal (Bloomberg)
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
| ⚠️ ClaimedDubai Courts, Dubai Land Department and RTA | United Arab Emirates | 13 Apr 2026 | Government | Intrusion | Handala | Claimed. Handala claimed it breached the three Dubai government bodies, destroyed 6 PB of data and stole 149 TB. The claims are unverified. | Security Affairs✓ 8 Nov |
 ✅ ConfirmedStryker (Cork operations) | Ireland | 11 Mar 2026 | Health | Not disclosed | Handala | Confirmed. A global disruption to Stryker's Windows environment hit its Cork base. The NCSC said it was aware of the incident and was liaising with international partners. Claimed. Iran-linked Handala said it wiped over 200,000 systems and took 50 TB of data. AFP could not verify this. | RTÉ✓ 8 Nov |
| ⚠️ ClaimedSharjah National Oil Corporation | United Arab Emirates | 3 Mar 2026 | Energy | Intrusion | Handala | Claimed. Handala posted the company on its leak site and claimed to have taken 1.3 TB of financial data, oil contracts and project files. | ransomware.live✓ 8 Nov |
 ⚠️ ClaimedSaudi Aramco | Saudi Arabia | 3 Mar 2026 | Energy | Intrusion | Handala | Claimed. The Iran-linked group Handala claimed a breach and posted watermarked engineering documents. TechJuice found the documents dated to about 2016 and saw no evidence of a fresh compromise. Aramco has not commented. | TechJuice · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedClalit Health Services | Israel | 25 Feb 2026 | Health | Data leak | Handala | Claimed. Handala said it breached Israel's largest healthcare network and released medical information on more than 10,000 patients. | Times of Israel✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology