Israel Institute for National Security Studies (INSS) Listed by Handala Ransomware Group

On March 4, 2026, the Israel Institute for National Security Studies appeared on the leak site of the handala ransomware group, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates the Israel Institute for National Security Studies, commonly known as INSS, was listed on the handala leak site hosted at handala-hack.to. The group posted a message accusing the institute of deception and media manipulation while declaring the breach part of a larger ideological conflict. Available reporting describes the incident as a ransomware attack in which internal files were taken, though the exact volume and specific types of documents remain unconfirmed in initial posts. No precise count of affected individuals has been released, and it is not yet clear whether any personal data belonging to staff, researchers, or affiliated individuals was included in the exfiltrated material.

Why This Matters for You and Your Family

When a research institute focused on national security is breached, the files taken can contain contact details, correspondence, and other records that ultimately trace back to ordinary people. If your name, email address, phone number, or family connections appear in any of those documents, the information can surface in unexpected places. Credential leaks from such incidents often spread beyond the original target, increasing the chance that accounts you use every day become targets. For families, this risk extends to shared email addresses, spouse accounts, and even children’s online profiles that reuse similar login details.

Data exposed in these attacks rarely stays contained. Once internal files leave a secure environment, copies can circulate on multiple underground forums, giving cybercriminals repeated opportunities to piece together personal information over time.

The Doxxing and Identity-Chain Implications

Ransomware groups increasingly combine stolen institutional data with information already circulating from earlier breaches. A single leaked email or phone number can be linked to your social-media handles, gaming usernames, and family members’ accounts. This process, known as identity chaining, allows attackers to build a detailed profile that leads to harassment, targeted phishing, or full account takeovers. Gaming accounts belonging to children are especially vulnerable because they frequently share the same email domain or password patterns as adult accounts used for work or research correspondence. When those connections are mapped, a breach at an institute like INSS can cascade into doxxing attempts against researchers’ households.

Handala Group’s Publicly Known Track Record

Public reporting attributes the handala ransomware group with emerging in late 2024 or early 2025. The group has claimed responsibility for attacks on organizations across the Middle East, frequently pairing technical breaches with ideological statements. Notable prior victims include other Israeli-linked entities and institutions the group views as aligned with opposing political positions. Their typical playbook involves initial access through phishing or unpatched remote services, followed by claimed exfiltration of internal documents, and publication on a dedicated leak site when ransom demands are not met. The extortion style mixes financial pressure with public shaming messages that reference the victim’s mission or public statements.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the INSS breach.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours rather than months.
• Rotate any password you used at the Israel Institute for National Security Studies or any related research portal, then enable two-factor authentication with an authenticator app everywhere that same password was reused.
• Cover the household with DoxxScan family protection that extends to your children’s gaming accounts, which often become the weakest link in identity-chain attacks.
• Let remediation specialists perform hands-on takedown work across data brokers and leak sites so you do not have to negotiate or chase removal requests yourself.

The incident shows that even specialized research organizations can become entry points for broader personal exposure. Taking concrete steps now limits how far attackers can travel along any identity chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with coverage that includes your entire household and children’s gaming accounts. Start your DoxxScan trial today to close the gaps before the next wave of leaks appears.