Handala Hack, a hacktivist persona described in reporting as Iranian-backed, says it breached the government of St. Joseph County, Indiana, the county that includes South Bend and the University of Notre Dame. The group claims it took about two terabytes of data, including employee records, police reports, court documents, health reports and death certificates. That figure comes only from the group's claim as relayed by secondary sites. No source here independently verifies it. Two of those sites say county officials have acknowledged an incident but describe it as limited to a third-party virtual faxing system. None of the eight sources available for this brief is a primary county statement, a regulator filing or a CERT advisory. The intrusion has been claimed and partly acknowledged, but its full extent is not confirmed.
What Happened
Handala Hack has publicly claimed responsibility for a breach of St. Joseph County government systems (S1, S3). The same reporting says the group also claims to have compromised the personal email of FBI Director Kash Patel (S1). We could not corroborate that claim, and this brief treats it as unverified.
The county's response, as relayed by S1 and S3, plays down the group's account. Officials reportedly say the compromise was limited to a third-party virtual fax service, not the county's core network. S3 adds that the issue was "identified and resolved relatively quickly." We have not seen the original county statement, so this account is second-hand.
Accounts of the scope differ:
- Handala Hack (via S1, S3): about 2 TB of county data covering several government functions.
- County officials (via S1, S3): exposure limited to a vendor-run faxing system.
- Vantage Point Consulting (S2): says Iranian-linked hackers "claimed control of" the county's "infrastructure, records, and systems." This goes further than the other reporting and appears to restate the attacker's claim, not an independent finding.
No source gives a date of compromise, a date of discovery or a number of affected people. We found no breach notification filing for the county (S4 describes the state Attorney General registries where such filings would eventually appear).
A note on a source that does not apply: S5 is the profile of the IT Director of St. Joseph County, Michigan, a separate county of about 60,000 people based in Centreville, MI. It has nothing to do with the Indiana incident. Defenders and journalists should be careful not to mix up the two counties.
What Was Taken
All of the following comes from the attacker's claim, not from a confirmed inventory:
- Volume: about 2 TB (Handala claim, via S1 and S3)
- Claimed categories: county employee records, police reports, court documents, health reports and death certificates (S3; S1 names police reports, court documents and death certificates)
If the county's account is right and the breach was limited to a virtual fax platform, the exposure still matters. Local governments use fax to send exactly these kinds of documents: medical records, court filings, law enforcement paperwork and vital records. A compromised fax archive could plausibly hold sensitive documents from many departments without anyone touching the county's main network. So the two accounts may be closer than they look. The real dispute is over volume and how deep the access went, not necessarily over the types of data.
For comparison, Winona County, Minnesota, has just begun notifying residents about a ransomware attack between March 13 and April 7, 2026. That incident exposed SSNs, driver's licenses, medical and insurance data, law enforcement report contents, fingerprints and DNA paternity reports (S6). It shows how much regulated and highly sensitive data a single Midwest county can hold.
Why It Matters
Nation-state-linked targeting of local government. Handala presents itself as a hacktivist group, but reporting describes it as Iranian-backed (S1, S2, S3). Counties are attractive targets for this kind of actor. They hold sensitive records on residents, police and courts, but their security budgets are much smaller than federal agencies'. A county also gives the group a US government victim it can publicize for propaganda value, whether or not the claimed volume is accurate.
Inflated claims are part of the playbook. Hack-and-leak personas regularly overstate what they took to increase psychological impact. That makes a fast, specific and verifiable public statement from the victim important. Until St. Joseph County publishes details of scope, affected people and the vendor involved, the attacker's version will dominate coverage. S1 already asks whether "we [are] getting the full picture."
Third-party SaaS is the soft perimeter. If the county's account holds, this is another case where a vendor platform, not the organization's own hardened network, was the way in. Cloud fax, e-signature, records-request portals and similar services often sit outside central monitoring and identity controls.
A county that is investing, but not everywhere. St. Joseph County records show recent security spending. In September 2026, commissioners renewed KnowBe4 phishing and awareness training (S7) and renewed UncommonX managed detection and exposure management for the 911 dispatch center (S8). Those controls protect people and dispatch infrastructure. They do not necessarily cover vendor-hosted document services. The lesson is that you need to know where your data actually lives, not only where your network is.
Regional context. S2 counts 43 confirmed cyberattacks on large organizations across 12 Midwest states from March 2021 to March 2026, and notes that the St. Joseph County claim came after its dataset was compiled. Public reporting likely undercounts these incidents.
The Attack Technique
No source here describes how the intrusion happened. Neither Handala nor the county (as relayed) has disclosed an initial access vector, malware, exploited vulnerability or indicators of compromise.
The only technical detail is the county's reported statement that the affected system was a third-party virtual faxing service (S1, S3). Common ways into platforms like this include:
- Stolen or reused credentials for the vendor's web portal, especially without MFA
- Compromise of the vendor itself, giving access to many customer tenants
- Misconfigured or over-broad API keys, email-to-fax gateways or archive storage
These are general possibilities, not findings about this incident. Defenders should wait for vendor or county disclosure before treating any of them as confirmed.
What Organizations Should Do
- List every vendor platform that handles documents. Cloud fax, e-signature, records-request portals, court e-filing and body-cam storage all hold sensitive data outside your core network. Record what each one keeps, for how long, and who can reach it.
- Require SSO and phishing-resistant MFA on vendor portals. Connect SaaS admin and user access to your central identity provider so you can disable accounts and review access logs in one place. Disable local passwords wherever the vendor allows it.
- Limit retention in transit systems. Fax and file-transfer services should not be long-term archives. Set short automatic deletion and move records into governed systems of record. You can't lose data that isn't there.
- Send vendor logs to your monitoring. If you pay for managed detection, as St. Joseph County does for its 911 center (S8), make sure SaaS audit logs (logins, bulk downloads, API use) reach that provider, not only endpoint and network data.
- Write contract terms for breach notification. Vendor agreements should require notice within hours, give you the right to forensic findings, and cover notification costs. Vague vendor contracts are the reason many local governments can't quickly answer "what was taken?"
- Prepare for hacktivist claims before one happens. Have a holding statement and a fast process for checking leaked samples against your own systems. A quick, specific and accurate public response limits the propaganda value that groups like Handala are looking for.
Sources: Iranian-Backed Hacker Group Claims St. Joseph County Data Breach: W... | Just how many cyberattacks are there in the Midwest? We ... | Iranian-backed Hackers Target St. Joseph County: Data Breach Expose... | Data Breach Checker: Search 6,500+ Company Breach Notices | Dustin Bainbridge | Winona County begins notifying residents about information stolen d... | County approves cybersecurity training, help-desk tools and dispatc... | Commissioners approve renewal of managed cybersecurity services for...