On December 23, 2024, the funksec ransomware group listed what it claims is internal data belonging to more than 10 million Israelis for sale on its leak site.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch this company
Get alerted the next time this company files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about this company’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the group posted a sales thread on its dark-web leak portal describing files exfiltrated during a ransomware incident. The listing appeared on a Tor-based site tracked by ransomware.live. Available details describe the material as internal files taken after the attackers gained access to victim networks. Exact victim identities have not been publicly confirmed by any Israeli organization, and the precise number of individuals whose records are included remains unverified by independent third parties. The post sets commercial terms for purchase of the archive.
Why This Matters for You and Your Family
When a dataset this large appears for sale, the risk extends far beyond the original target. If your personal information or that of your spouse, children, or parents is inside, it can be bought by identity thieves, stalkers, or fraudsters within hours of the listing. Names, addresses, phone numbers, email accounts, and government ID details are typical contents of such caches. Once sold, the data fuels account takeovers, tax fraud, loan applications in your name, and harassment campaigns. Families often discover the breach only after damage has occurred because most people do not routinely check dark-web marketplaces.
The Doxxing and Identity-Chain Risk
Ransomware leaks rarely stop at one record set. Attackers and subsequent buyers map connections between leaked emails, phone numbers, gaming usernames, and social-media handles. A single credential from this incident can unlock linked accounts across banking, email, school portals, and online games. Children’s gaming accounts are especially vulnerable because parents often reuse passwords or security questions that appear in family data breaches. These chains accelerate doxxing: an attacker who obtains one piece of information can rapidly assemble a full profile including home address, family members’ names, and daily routines.