Handala Hack, an Iranian-linked hacktivist persona that U.S. authorities have tied to Iran's Ministry of Intelligence and Security, has claimed a breach of St. Joseph County government systems and says it exfiltrated roughly two terabytes of county data including employee records, police reports, court documents, health reports and death certificates. County officials have publicly disputed the scale of the intrusion. Reporting on the county's response is not consistent: one account (tachiuokoshien) says officials characterised the breach as "minimal," while another (prairiecomputer) says the county stated the compromise was limited to a third-party virtual faxing system. A 6abc Action News post reports the county placed initial access on June 26. No primary county notification, regulator filing or CERT advisory is available in the current source set, so every figure below is attributed rather than confirmed.
What Happened
The available accounts agree on the outline and diverge on the substance. Handala Hack publicly claimed responsibility for compromising St. Joseph County computer systems, and both outlet-tier writeups place the claimed haul at two terabytes. Prairiecomputer identifies the victim as St. Joseph County, Indiana; tachiuokoshien does not name a state. That distinction matters, because multiple U.S. counties carry the name, and the 6abc Action News item that supplies the June 26 intrusion date is a social post from a Philadelphia-market broadcaster rather than a county release. Treat the June 26 date as single-source and geographically unverified until the county publishes its own timeline.
The county's own position is the least clear part of the record. The two summaries of it are not obviously reconcilable: "the breach appears minimal" and "the breach was limited to a third-party virtual faxing system" are different claims, one about severity and one about scope and blast radius. If the faxing-vendor framing is accurate, the county is asserting that its core systems were never entered and that the exposed material transited a supplier's platform. If so, the volume claimed by the actor and the volume the county is accounting for are measuring different things, which is the most likely explanation for the gap. Prairiecomputer also reports the issue was identified and resolved relatively quickly. Commenters on the 6abc post report a surge in spam calls since the incident and note the county has had prior problems; that is anecdote, not evidence, and it is recorded here only as sentiment.
What Was Taken
The only volume figure in circulation is the actor's: two terabytes, asserted by Handala and repeated by both outlet-tier sources. No source attributes a record count, a data volume or an affected-individual count to the county itself. There is no confirmed number.
The claimed data categories are consistent across both writeups and are, if accurate, severe:
- County employee records, which typically carry Social Security numbers, home addresses, banking details for payroll and dependent information
- Police reports, which can expose victim and witness identities, informants, juvenile records and open investigative detail
- Court documents, including material that may be sealed or otherwise restricted
- Health reports, which raise HIPAA exposure depending on the originating county function
- Death certificates, which are a well-worn instrument for synthetic identity fraud and estate and benefits fraud
One analytic caution on the headline number. Picus Security's timeline of the group records that in March 2024 Handala threatened to leak two terabytes of internal data from Israeli radar firm DRS RADA. The recurrence of the identical figure is a reason to treat "2TB" as a rhetorical unit in this group's messaging rather than a measured volume, absent a published sample or a file tree.
Why It Matters
The attribution picture around Handala changed materially in 2026, and it changes how a county-level incident should be read. Dataminr assesses with high confidence that the Handala Hack persona is institutionally attributable to Iran's MOIS, grounded in a March 2026 U.S. Department of Justice enforcement action whose domain seizure explicitly and repeatedly characterises Handala-linked infrastructure as MOIS-controlled. That is an evidentiary legal finding, not a vendor hypothesis, and it converges with independent multi-vendor tracking of the same activity cluster under the names Void Manticore, Storm-0842 and Banished Kitten.
Dataminr draws a sharp line around a second claim: reporting that a named senior MOIS official personally commanded the unit and was killed in Israeli strikes is assessed only at low-to-moderate confidence, resting on a single Telegram statement and secondary reporting with no primary corroboration. Notably, Handala-attributed activity, including a major destructive attack, continued after that reported death, which Dataminr reads as evidence the unit is a standing institutional organisation rather than a personality-dependent crew. For defenders, that means operational tempo is not going to fall off because of leadership losses.
The practical implication for U.S. local government is that a county records system is no longer only a ransomware target. It is a target for an intelligence-service-linked actor whose recent pattern, per Picus, includes a "RedWanted" site launched 1 March 2026 naming individuals and organisations that supported Israel and stating it would "hunt" them, a wiper attack on U.S. medical device manufacturer Stryker, and the publication of over 300 emails claimed to come from FBI Director Kash Patel's personal account. Against that backdrop, stolen police reports, court records and employee rosters have doxxing and targeting value independent of any resale market.
The Attack Technique
No source describes the initial access vector for the St. Joseph County incident specifically. The strongest available signal is the county's reported statement, via prairiecomputer, that the exposure involved a third-party virtual faxing system, which would point to supplier compromise or credential abuse against a vendor platform rather than a direct intrusion into county infrastructure. That remains the county's assertion and is unverified.
The group's established tradecraft, per Picus, is structured and multi-stage: phishing emails carrying malicious attachments as the delivery mechanism, wiper malware that overwrites files with randomised data and permanently deletes them to render systems unbootable, and Telegram-based command and control alongside Telegram as the primary leak and extortion channel. The absence of any reported destructive outcome in St. Joseph County is worth noting. This claim is presented as data theft, which fits the hack-and-leak influence half of the group's repertoire rather than the wiper half. Organisations that see Handala-consistent activity should assume the wiper capability is still on the table.
What Organizations Should Do
- Inventory and scope every third-party document-handling service. Virtual fax, e-signature, records-request portals, court e-filing intermediaries and print or mail vendors routinely hold the same sensitive material as core systems with a fraction of the monitoring. Enumerate what each holds, for how long, and who at the vendor can read it.
- Force SSO, phishing-resistant MFA and IP restriction on vendor platforms. Legacy fax and document services frequently sit outside identity management on shared or static credentials. Where a vendor cannot support FIDO2 or SAML, treat that as a procurement blocker and document the accepted risk.
- Cut retention hard on high-consequence records. Death certificates, police reports and employee PII sitting indefinitely in a third-party queue turn a minor vendor incident into a mass disclosure. Set and enforce automatic deletion at the vendor tier, then verify it.
- Harden against the phishing-to-wiper chain. Attachment detonation, macro and script execution controls on endpoints, and application allowlisting address Handala's documented delivery path. Pair it with immutable, offline-verified backups and a tested bare-metal restore, since the group's signature outcome is unbootable systems, not encrypted ones.
- Monitor Telegram and leak infrastructure for your own data. This actor publishes rather than negotiates. Standing collection against the group's channels and the RedWanted listing gives faster notice than waiting on a vendor disclosure, and it lets you validate or refute volume claims like the 2TB figure with your own eyes.
- Publish a clear, versioned incident statement and update it. The public confusion here, minimal versus vendor-limited, is a communications failure as much as a security one. State scope, systems involved, data categories, dates and what remains under investigation, and correct the record as facts firm up. Residents reporting spam-call spikes need somewhere authoritative to look.
Sources: Iranian-Backed Hacker Group Claims St. Joseph County Data Breach: W... | Iranian-backed Hackers Target St. Joseph County: Data Breach Expose... | Handala Hack: Confirmed Iran MOIS Attribution & Unverified Command... | Handala Threat Group Tactics, Targets, and Attack Timeline | The county says hackers were able to get into the system ...