Adversary Intelligence — 2026-10-18

Handala Hacking Group Breaches Data of Mossad-Linked Netanyahu Ally Safadi and Publishes 80 Pages of Communications

BLUFHandala is likely to publish additional leaked data naming at least one more Israeli-linked individual within the next month, sustaining pressure on Netanyahu's network through unverified but politically damaging disclosures.

WANA reported on October 16 that the Handala hacking group claimed to have breached data belonging to Mendi Safadi and released 80 pages of his conversations and contact information on the "DropSite" and "DDoS Secret" websites 1. Handala describes Safadi as a Druze figure tied to Mossad's Arab affairs division and head of the Safadi Center, whose Abraham Accords work the group calls a cover for Mossad objectives 123. Per Handala's account, relayed by WANA, ABNA, and Defa Press, the messages show Safadi brokering Arab political support for Netanyahu amid his criticism of Gadi Eisenkot over Arab voter outreach, and discuss Safadi Center funding 123. Handala also alleged Safadi privately blamed Netanyahu for the October 7 failures and played a role in Israeli projects in Syria tied to Bashar al-Assad's ouster. It said the release is only part of its data and that it will keep publishing on officials and networks it links to Israel 123. All three outlets relay Handala's statement, and none reports independent verification of the material or any response from Safadi.

Analysis
Handala will likely publish a further leak naming at least one additional Israeli or Israel-linked individual by November 18, extending the pattern the group set by promising more data and continued exposure of officials and networks. Confidence is low because everything rests on one claimant statement, relayed by three outlets, with no independent check of the dataset and no sign of what Handala holds next. Safadi has not responded. The operation may instead have been a one-off influence operation timed to Israeli electoral politics, and the promise of more material is rhetoric rather than a pipeline. If further leaks appear, Israeli officials and outside defenders should prepare notification, exposure checks and counter-messaging. If they do not, those resources can be held back.

3 sources