Can you provide more detail about how you've put this together? Are you simply displaying a link on a workspace form? Do your links work in a different role such as Admin?
I have had the same issue after reading the article Service Request Offerings: Embed Attachments in the Request Form?
You will have to add a "/HEAT/" in your <a> href attribute:
$("<a target='_blank' href='/HEAT/handlers/DownloadAttachmentHandler.ashx?objectid=6EFBD28620C24F8FAFD2985DF3C979C1'>icon_NewIncident</a>")
It should look like this: