Handala’s 150GB Claim: What the Israeli Data Theft Proves

WarBrief Live | October 26, 2026 | Cybersecurity

An Iran-linked hacking group called Handala claims it has stolen 150 gigabytes of confidential Israeli court, police and security material from a transcription system built by the Israeli technology firm Malam. The claim, reported on October 26, 2026, is unconfirmed: neither Israeli authorities nor Malam had issued a statement on the allegation at the time of reporting. This article separates what Handala claims from what independent and official sources have actually verified, because in this group’s recent history the two have often differed sharply. The handala 150gb israeli data theft explained here is therefore a story about evidence as much as about hacking.

What did Handala claim about the E-Type system?

According to a report by Yeni Safak, citing Iran’s Fars news agency, Handala said it infiltrated the “E-Type” system developed by Malam, a system the group described as designed to transcribe and archive confidential judicial materials. The material allegedly taken includes audio recordings and transcripts drawn from confidential court proceedings, police investigations and sensitive security files, with records related to thousands of security cases. Handala described the penetration as a severe blow to Israel’s security infrastructure and linked it to Prime Minister Benjamin Netanyahu’s electoral security pledges.

Handala also said it carried out a multilayered supply-chain attack to reach the archived audio and transcripts, and that it published 150 gigabytes of the data on its website as verification of the breach. That last detail matters, and it cuts both ways. A public dump, if genuine, can be independently examined. But a download link on a hacking group’s own site is not independent verification: it is the claimant offering its own evidence, and the authenticity, completeness and provenance of such material still have to be checked file by file. Until an independent outlet, a researcher or an official body confirms that the files are what Handala says they are, the responsible description is a claim, not a breach.

A supply-chain attack, in general terms, means compromising a vendor, a service or a software component in order to reach the vendor’s customers, rather than attacking each customer directly. That is why the alleged target matters here: a transcription provider sits between courts, police and security bodies and the records they produce. If a provider of that kind were compromised, the exposure could in principle extend beyond one institution. But that is a statement about the architecture of such systems, not a finding about this case. No reporting reviewed for this article establishes that Malam’s system was in fact breached, or how any intrusion, if it occurred, was carried out.

What has actually been verified so far?

What is confirmed is narrow, and it is worth stating plainly. It is confirmed that Fars reported the claim, that Yeni Safak and other outlets relayed it on October 26, 2026, and that, at the time of that reporting, neither Israeli authorities nor Malam had issued a statement on the allegation. An independent relay of the claim likewise described the alleged breach as unconfirmed by Israeli officials. Everything beyond that — the 150-gigabyte total, the supply-chain method, the claim that thousands of security cases are involved — rests on Handala’s own account as reported by Fars.

That distinction is not pedantry. It is the pattern of Handala’s October. On October 24, 2026, Haaretz reported that Handala had leaked photographs of a senior Israel Defense Forces officer and his family, along with his schedule and military files, and that the IDF said the breach was under investigation. Haaretz also noted, in its broader reporting on the group, that Handala has combined information obtained through genuine breaches with publicly available material and fabricated or false claims. A leak can therefore contain real material and still be wrapped in exaggerated or false claims about how it was obtained and what it proves.

The October 21-22 episode points the other way. Handala released videos it said were filmed inside Israeli military bases and claimed its operatives were moving among military ranks. According to UrduPoint, citing Israeli media and Walla Technology, Israel’s National Cyber Directorate found, on initial review, no evidence of a hack into military base systems or infrastructure, and officials suggested the material may previously have been held by a private individual. Haaretz’s own review of the videos suggested they consisted, at most, of very short clips filmed by soldiers during operational activity, with the source unclear. The group’s claim of an ongoing infiltration of bases was not verified.

By the numbers: confirmed versus reported

The table below keeps the two categories apart. “Confirmed” means supported by at least two sources or by an official or reputable-outlet finding. “Reported” means it comes from Handala’s account or a single relay of it and has not been independently confirmed.

Caveat: figures marked REPORTED are Handala’s claims as relayed by other outlets, not independently verified facts. Figures marked CONFIRMED are supported by official findings or reputable reporting, as cited.

Why does a court transcription archive matter to attackers?

Court and police transcripts are a distinctive kind of target. They are not merely administrative records. Transcripts of hearings, interrogations and investigations can contain testimony, identities, operational detail and material that was never intended for public release. That is why courts and police forces normally restrict who can access them, and why a transcription contractor, which handles audio and text on behalf of those institutions, can become a high-value intermediary: compromise one provider and, in theory, you reach the records of many cases at once.

That logic also explains why verification matters more, not less, in a case like this. If the claim were true, the exposure could affect people named in proceedings, ongoing investigations and the willingness of witnesses to speak freely. If the claim were exaggerated or fabricated, repeating it as fact would still spread the group’s message and could still cause alarm among people who cannot check the underlying files. Either way, the public interest is served by precision: what was claimed, by whom, through which outlets, and what remains unchecked.

There is a further reason for caution. Transcription systems also raise a quieter question about the security of the justice system itself. Courts increasingly rely on digital recording, automated transcription and remote hearings, and each of those steps adds a vendor, a network connection and a storage system to the chain of custody. A claim against one such system, even an unconfirmed one, is a prompt to ask how those chains are audited, who holds the keys, and how quickly a court would know if its archive had been copied. Those questions do not depend on Handala telling the truth.

How Handala’s October claims compare

Handala’s October has been a drumbeat of releases, and reading them together is the best available guide to the new claim.

• October 15, 2026: Reports and analysis of a phone-related leak involving former foreign minister Tzipi Livni circulated, with analysis arguing the material did not prove a phone hack and noting that former prime minister Naftali Bennett had said fabricated chats were mixed into material attributed to him. The episode is best described as a disputed leak, not a proven device compromise.
• October 18, 2026: Handala said it had infiltrated an Israeli military unit responsible for monitoring and analysing media intelligence, releasing more than 500 classified documents and tens of thousands of internal messages. That remains a reported claim; it is cited here as Handala’s account, not as a verified breach.
• October 21-22, 2026: Handala released videos said to show the inside of military bases, claiming ongoing infiltration. Israel’s National Cyber Directorate found no evidence of a base-system hack on initial review, and Haaretz’s review pointed to short clips likely filmed by soldiers. Claim not verified.
• October 24, 2026: Haaretz reported the leak of a senior IDF commander’s photographs, schedule and military files, with the IDF saying the breach was under investigation. Material reviewed as genuine in part, with the full scope still under investigation.
• October 26, 2026: The E-Type claim: 150 gigabytes of court, police and security transcripts allegedly taken via a supply-chain attack. Unconfirmed at time of reporting.

For wider context, see WarBrief’s Conflict Zones hub, our earlier Israel-Iran cyber war analysis, and our Phantom AI ransomware framework explainer on how automated intrusions are changing the threat picture. The pattern is not one of uniform truth or uniform falsehood. It is a mix: some material that reputable reporting treats as genuine, some claims that official review has not supported, and a consistent effort to frame each release for maximum political effect. That is exactly why a single new claim, however large the number attached to it, should not be reported as a confirmed breach on the strength of the claimant’s word.

What the Handala 150GB claim means for US/UK/EU readers

For readers in the United States, the United Kingdom and the European Union, this story is not only about Israel’s election or Iran’s cyber capabilities. Three practical consequences are worth noting. First, election-eve cyber claims are now a recurring feature of democratic votes, and the discipline they demand is the same everywhere: treat a hacking group’s announcement as a claim, wait for independent confirmation, and be wary of material that is designed to be shared before it is checked. The same test applies whether the target is a court archive, a campaign or a ministry.

Second, the supply-chain angle is directly relevant to Western institutions. Governments, courts and companies across the US, UK and EU all rely on specialist vendors for transcription, cloud storage, payroll, legal and communications services. A vendor compromise can expose many clients at once, and the defences that matter are unglamorous: vendor security audits, limits on what a contractor can access, logging that would reveal bulk copying, and a plan for notifying affected people quickly. Readers who work in or with public institutions should ask whether their own suppliers are held to those standards.

Third, there is a market and security signal to read with care, not alarm. A credible, confirmed breach of a judicial archive would raise questions about the security of sensitive state data and could sharpen tensions between Israel and Iran at an already volatile moment. An unconfirmed claim, amplified without qualification, can do some of the same damage to confidence without any breach having occurred. The difference between those two outcomes is verification, and it is the reason this article leads with what is unconfirmed rather than with the largest number in the claim.

None of this is financial advice, and none of it is a prediction about markets. It is a reminder that cyber claims, like market rumours, move faster than evidence, and that the cost of waiting for evidence is usually lower than the cost of acting on a claim that turns out to be false.

What to watch next before and after Israel’s October 27 election

The first thing to watch is whether Malam or an Israeli authority issues a statement. A confirmation, a denial or a statement that an investigation is under way would each change the status of this story materially, and this article’s central claim — that the breach is unconfirmed — would need to be updated accordingly. The second is whether independent researchers or journalists who examine the published material report that the files match genuine court or police records, or that they are recycled, mislabelled or fabricated. That kind of file-level checking is slower than a press release, but it is the only route from claim to fact.

The third is whether Handala follows the pattern of its recent releases with further dumps in the days after the election, and whether those dumps are treated with the same scrutiny. A group that releases material on a political timetable is engaged in influence as well as intrusion, and its releases should be read as both. Finally, watch whether Israeli institutions say anything about the security of transcription and archive vendors more broadly. A general statement about audits or protections, even without reference to this claim, would tell readers something about how seriously the system takes its weakest link.

WarBrief will update this assessment if Malam, Israeli authorities or independent verification change the picture. Until then, the accurate headline is the careful one: a group claims a major theft, and nobody who could confirm it has done so.

Frequently asked questions

What is the Handala 150GB claim?
Handala claims it breached Malam’s E-Type transcription system and stole 150 gigabytes of court, police and security transcripts, publishing the material for download. The claim was reported by Fars and relayed on October 26, 2026. It has not been confirmed by Israeli authorities or Malam.

Has the E-Type breach been confirmed?
No. At the time of reporting, neither Israeli authorities nor Malam had issued a statement on the allegation, and independent outlets relaying the claim described it as unconfirmed. The 150-gigabyte figure is Handala’s claim, not a verified fact.

Who is Handala?
Handala is an Iran-linked hacking group that has targeted Israeli political, military and security figures and institutions, including through leaks of personal data and documents. Its releases have mixed material that reputable reporting treats as genuine with claims that official review has not supported.

What is a supply-chain attack?
A supply-chain attack compromises a vendor, service or software component in order to reach that vendor’s customers, rather than attacking each customer directly. Handala claims it used a multilayered supply-chain attack against the E-Type system; that method has not been independently confirmed in this case.

Why does the timing matter?
The claim surfaced on the eve of Israel’s October 27, 2026 election, and Handala has linked recent releases to the election campaign. Timing does not prove a claim false, but it is a reason to require independent verification before treating it as fact.

Sources

• Yeni Safak: Iranian group Handala claims theft of 150GB of Israeli data
• InfoHandle: Handala Claims 150-Gigabyte Theft From Israeli E-Type Court and Police Archive
• Haaretz: Iranian Hackers Expose Senior IDF Commander, Leak Data Endangering Top Officers
• UrduPoint: Videos Of Israeli Military Bases Leaked As Iranian Hackers Claim Access To Sensitive Information
• Press TV via report: Handala leaks 500 classified files from Israeli military unit
• OctoProbe: Handala’s Livni Phone “Leak”: Signature Reduction in War