What is claimed, and what is not
On 25-26 October 2026, regional outlets reported that the Iran-linked Handala group had breached "Etype", a transcription and recording system built by the Israeli firm Malam. Handala says it took 150 GB of court-session and security recordings and posted them as proof. Yeni Şafak's report, published 26 October, attributes the claim to Iranian state media. It adds that neither Israeli authorities nor Malam had issued a statement. We therefore treat the breach as an unverified claim. Nobody has independently authenticated the files, and the "multilayered supply chain attack" description comes from the group itself.
Even so, the claim is a useful test for the National Cyber Defense Bill. It passed its first Knesset reading on 8 June 2026, according to the law firm Gornitzky's summary. That summary says the bill "has not yet been approved and may still undergo changes".
The case for the bill
The strongest argument for the bill is that Israel's civilian cyber defense has run on government resolutions rather than statute, so the National Cyber Directorate has had little binding authority over the private firms that hold sensitive state data. The bill would change that. Gornitzky reports that "essential organizations" must report significant attacks to the Directorate and their sector regulator. It also reports that they must meet baseline duties covering "supply chain risk management" and incident reporting. The Directorate head could issue written orders when a risk "may enable a severe cyberattack". In a severe attack, those powers could extend to digital or hosting providers that are not classed as essential. Administrative sanctions for most violations reach NIS 640,000, and officers can face personal fines for failing to supervise.
If the Etype claim is true, this is the gap the drafters had in mind. A vendor that transcribes court sessions sits one step removed from the state, and Handala's own account is that it entered through the supply chain. Supplier duties and mandatory reporting would address that route directly. They would also give the Directorate visibility it currently lacks.
Why "extortion policy" is the wrong frame
The leak-and-extort label does not describe this attack well. The sources we reviewed do not mention ransomware, extortion or ransom-payment provisions in the bill. The one law-firm summary we could read says nothing on the subject, and the bill text on gov.il returned a 403 error to our fetcher. Handala's apparent goal is also not a payment.
The FBI's FLASH of 20 March 2026 says Handala Hack "is known for phishing, data theft, extortion, and destructive attacks involving custom wiper malware". It assesses the group is linked to "Homeland Justice", which is also operated by Iran's Ministry of Intelligence and Security (MOIS). It describes the typical campaign as theft of sensitive data, "its manipulation or selective exposure", and distribution through aligned media "to maximize reputational or political damage".
That pattern matters for policy. A ransom ban, a payment-reporting duty or a sanctions-screening rule works on criminals who want money, because it changes whether paying makes sense. A state-directed group that publishes for effect has no use for a payment, so those tools do nothing against it. Handala's record also shows disruption rather than cash. BleepingComputer reported on 19 March 2026 that the FBI seized two Handala domains. It also described the attack on Stryker, in which an Intune wipe command reset roughly 80,000 devices. CISA's 18 March alert tied the Stryker incident to endpoint-management hardening. It named no actor, and its advice included multi-admin approval for actions such as device wiping.
What a proportionate response looks like
The policy lesson is to put effort where it works and avoid new restrictions that would not have stopped this kind of attack. Three points follow.
- Keep the obligations tied to essential services and their suppliers. The bill applies the full baseline to essential organizations and a lighter "reasonable measures" standard to everyone else. That tiering is right. A blanket duty on every software vendor would burden small firms, including Israeli startups, without reducing risk to court archives.
- Make reporting useful rather than punitive. A court-recording vendor that detects an intrusion should have a safe channel to the Directorate. If the first thing a vendor expects from disclosure is a fine, it will delay disclosure. The two-year limit on retaining personal data gathered under the bill is a sensible safeguard, and the Knesset committee should keep it.
- Don't write a payment ban to fit a headline. Israel's concern here is state-backed theft and publication. Criminalizing victims for paying criminals would add legal risk for hospitals and municipalities hit by ordinary ransomware and do nothing about a state actor that wants publicity.
There is also a free-expression angle. Leaked court and police recordings can include material about defendants, victims and witnesses. Rules that would punish a newsroom for reporting on already-public leaks would be a poor response, and any such provision should be rejected. Obligations should fall on the data custodian, not on those who discuss the leak.
What to watch
Two things will show whether the bill fits the threat. First, whether Malam or the courts confirm the breach and describe how access was gained. If it came through a supplier, the bill's supply-chain duties will look well aimed. If the claim collapses, it will be a reminder that Handala's operations are partly information warfare. Second, whether the Foreign Affairs and Defense Committee adds anything on ransomware as the bill moves toward its second and third readings. A narrower, resilience-first law, with clear supplier duties and protected reporting, is the proportionate option. Adding payment bans to answer a different threat is not.