Ransomware victim disclosure
← All victimsSima Shine / Mossad-affiliated Intelligence Institution
listed as Shock for Israeli Intelligence: 100,000 Classified Emails of Mossad’s Ex-Deputy Director S... · Claimed by Handala · listed 3 months ago
Status timeline
- Listed
Mar 16, 2026
- Data leaked
At a glance
- Group
- Handala
- Status
- Data leaked
- Country
- Israel
- Sector
- Public Sector
- Listed on leak site
- Mar 16, 2026
About the victim
AI dossier — public-source company profileThe victim is Sima Shine, former Deputy Director for Research of Mossad and former Head of the Iran Desk, currently leading an undisclosed Israeli intelligence institution. As a senior figure in Israel's intelligence community, she would handle highly classified national security correspondence. The targeted entity is part of Israel's state intelligence apparatus.
- Industry
- Government Intelligence & National Security
Attack summary
Severity: critical — Claimed exfiltration of 100,000 classified emails from a senior intelligence official with direct ties to Mossad and national security operations constitutes a critical disclosure involving highly sensitive government/intelligence data with potential national security implications.The group Handala claims to have hacked the personal email account of Sima Shine and exfiltrated over 100,000 emails described as ultra-classified, which are now being published or made available via the leak post.
Data the group says was taken
AI dossier — extracted from the leak post- Classified email correspondence
- Intelligence communications
- Personal emails of senior Mossad official
- Potentially sensitive national security documents
What the group claims
In an incident that sent shockwaves through the Israeli intelligence apparatus, the personal email of Sima Shine, the former Deputy Director for Research of Mossad, former Head of the Iran Desk, and current leader of one of Israel’s most secretive intelligence institutions, has been hacked. Now, over 100,000 of her ultra-classified emails are available for…
Sources
Source
Indexed 3 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.