Ayelet Shaked Contact List Listed by Handala Ransomware Group

On January 3, 2026, the Handala ransomware group published a 150-page internal contact list belonging to former Israeli Justice Minister Ayelet Shaked, exposing names, phone numbers, email addresses and other personal details obtained during a ransomware attack.

Reported Details of the Incident

Public reporting indicates the files were exfiltrated from an internal system during a ransomware incident and later posted on the group’s leak site. The released document runs 150 pages and contains Shaked’s professional and personal contacts. No confirmed total number of unique individuals appears in available reporting, but the scale suggests thousands of entries. The data includes direct identifiers that can be cross-referenced with other public records.

January 3, 2026 marks the publication date on the Handala leak site, hosted via ransomware.live. The group framed the release as “information infiltration” intended to expose networks of influence.

Why This Matters for You and Your Family

When high-profile contact lists appear in ransomware leaks, ordinary people whose information sits inside them suddenly become collateral targets. If your name, phone number, or email appears in Shaked’s contacts, attackers and opportunistic criminals can use that data to launch phishing campaigns, SIM-swapping attempts, or identity theft against you and your family. Children’s names or school-related contacts sometimes appear in such lists, creating long-term risks.

Credential leaks like this one frequently cascade into account takeovers on gaming platforms, social media, and email services. A single exposed email-password pair from an old breach can unlock family accounts when combined with fresh contact data.

The Doxxing and Identity-Chain Implications

Once a contact list is public, attackers begin mapping relationships. They link your phone number to your children’s gaming usernames, your work email to personal social-media handles, and your physical address to family members. These identity chains allow doxxing that escalates quickly from harassment to extortion or swatting. What begins as one leaked contact file can expose an entire household’s digital footprint across dozens of platforms.

Handala Group’s Known Track Record

Public reporting attributes the Handala ransomware group with operations that emerged in recent years. The group typically gains initial access through common ransomware vectors, exfiltrates sensitive files, and then uses public leak sites to pressure victims. Notable prior victims include various organizations whose internal documents were posted on similar onion-based leak portals. Their playbook centers on data exfiltration followed by timed public releases designed to maximize embarrassment and pressure.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you ever used on systems connected to the breached contact list and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your family’s daily digital life.

The incident demonstrates that contact lists once considered low-risk can rapidly become high-value targets for ransomware operators. Taking concrete steps now limits how far any single breach can spread through your family’s information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also protects children’s gaming accounts that frequently become entry points for further doxxing once a parent’s contact data leaks.