The Iran-linked hacking group Handala, also written Hanzala or Hanzalah, says it broke into "E-Type" (also written Etype). This is a transcription and archiving system built by the Israeli technology firm Malam. Handala says it published 150GB of audio recordings and transcripts from closed court sessions, police interrogations and security files. All the coverage traces back to one source: a report by Iran's state-linked Fars news agency on Sunday 25 October. Turkish outlets Yeni Şafak (via Anadolu Agency) and İşçi Haber repeated that report, and Ground News collected similar headlines. Israeli authorities and Malam have not commented. No regulator filing, government CERT statement or independent forensic review has been published. Several outlets have reported that data was posted, but none has verified it. For now this is a claim, not a confirmed breach.
What Happened
According to the Fars report, Handala says it got into the E-Type platform and accessed "all archived audio and transcripts." It then posted 150GB on its own website for anyone to download as proof. Yeni Şafak reports that the group called the intrusion a "severe blow" to Israel's security infrastructure and mocked Prime Minister Benjamin Netanyahu's security promises during the election campaign.
The timing is deliberate. WarBrief Live notes that the claim came out the day before Israel's 27 October election. Handala has openly tied its recent leaks to that vote.
Handala's recent record is mixed, which is a reason for caution. WarBrief Live reports two examples from October:
- Haaretz reviewed material from a Handala leak on 24 October and judged it genuine.
- Israel's National Cyber Directorate found no evidence that Israeli bases had been hacked, despite videos Handala released on 21 and 22 October claiming they had.
So past claims from this group have been true in some cases and inflated in others.
What Was Taken
Every account gives the same size, 150GB. That number comes from Handala itself, and nobody independent has counted or checked the files. Accounts differ on what the data contains:
- Yeni Şafak and İşçi Haber, citing Fars: audio recordings and transcripts from confidential court proceedings, police investigations and sensitive security files, covering "thousands of security cases."
- Headlines collected by Ground News: describe the system as holding records belonging to the Israeli government and military. One headline also adds security camera footage, which no other report mentions.
The more cautious description is court, police and security-service transcription material. The claims about military records and camera footage rest on single headlines. If the core claim is true, the data could include witness and informant identities, interrogation content, and evidence from closed hearings. That kind of material is much more sensitive than ordinary personal data, and leaking it cannot be undone.
Why It Matters
Transcription vendors hold a lot of sensitive data in one place. Courts and police send closed proceedings to outside transcription services. That makes a vendor like Malam a single point where many agencies' most sensitive material collects, and it is often protected less tightly than the agencies' own systems.
This is information warfare as much as data theft. Releasing the files before an election is designed to damage trust in the state's ability to protect secrets. That effect works whether the data is complete, partial or padded. Defenders and journalists should check the actual files before amplifying the group's account.
Israel's privacy regulator is now actively enforcing. Under Amendment 13 to the Privacy Protection Law, in force since 14 August 2025, organisations must report a serious security incident to the Privacy Protection Authority (PPA) immediately. The PPA has rejected the argument that reporting can wait until an internal investigation is finished:
- Kupat Holim Meuhedet was fined NIS 256,000 for reporting late, according to law firm Arnon, Tadmor-Levy.
- Menora Mivtachim was also fined NIS 256,000. Channel 14 reports the insurer waited 15 days to report an incident affecting 138 policyholders.
- Beit Shemesh Municipality was fined NIS 64,000, Arnon, Tadmor-Levy reports. Its security procedures did not cover outside service providers with access to its database, and a data processor was missing from its database specification document.
That last case matches the risk alleged here: a third-party processor holding public-sector data.
Lawyer Yaron Meiri notes that Israeli law has no 72-hour reporting window. The rule is "immediately." There is also no automatic duty to notify affected people, though the regulator can order it. Separately, an Israeli district court this month ordered compensation of about NIS 600,000 to former Bar Association head Efi Naveh over the use of material taken from his hacked phones. Anyone handling leaked Etype material should expect that public interest will not automatically protect them from privacy liability.
The Attack Technique
The only technical detail comes from Handala. It calls the operation a "multilayered supply chain attack." In other words, it claims it got in through Malam or the companies connected to it, rather than directly through a court or police network. The group has not released any indicators of compromise or described how it got initial access, and no vendor or government advisory has been published.
From its past campaigns, Handala is known for releasing stolen data for maximum attention. It has also been accused of exaggerating how big its intrusions are. Until Malam or the National Cyber Directorate comments, treat "supply chain" as Handala's own description, not a confirmed method.
What Organizations Should Do
- List every transcription, recording and archiving vendor that handles closed-hearing, interrogation or classified audio. Confirm what data each one holds, how long it keeps it, and whether they connect directly into your systems.
- Remove standing access for vendors. Require phishing-resistant MFA, access that is granted only when needed, and per-tenant separation on shared vendor platforms. One customer's credentials should never reach another customer's archive.
- Watch for unusual bulk data leaving vendor-hosted archives. Large audio or transcript exports, especially outside working hours or to unknown destinations, should raise alerts.
- Prepare a PPA report you can file immediately. Israeli regulators have fined organisations for waiting to finish investigations, so an initial report should go in as soon as a serious incident is suspected.
- Update database specification documents and security procedures to name every outside processor and their access obligations. The Beit Shemesh fine was about exactly this gap.
- Check leaked data before reacting publicly. If your organisation appears in the published set, compare samples against your own records before confirming or denying anything, and assume Handala will exploit any rushed statement.
Sources: Iranian group Handala claims theft of 150GB of Israeli data | Hanzala Claims to Have Leaked 150 GB of Confidential Data From Isra... | Handala 150GB Data Theft Explained: What Is Verified (2026) | מכה לגל״צ ולהדס שטייף: חויבו לפצות את עו״ד אפי נוה בכ־600 אלף שקל ב... | דליפת מידע בחברה: חובת הדיווח לרשות, תיקון 13 והחשיפה | Privacy Compliance Update: Enforcement Is Picking Up - Arnon, Tadmo... | מבוטחים במנורה? זהירות: המידע האישי שלכם עלול להיות חשוף - ערוץ 14... | İsrail'in Gizli Arşivi Hackerların Eline Geçti - İşçi Haber