Beit Handesai Listed by malekteam Ransomware Group

On January 15, 2024, Israeli engineering firm Beit Handesai (בית ההנדסאי) appeared on the leak site of the malekteam ransomware group. The listing claims the attackers exfiltrated internal files containing personal information on more than 60,000 persons and companions, including names, identity numbers, contact numbers, emails, phones, home addresses, and PDFs of passports. The group states it has destroyed all data after the successful cyber attack.

Details in the Leak Listing

The malekteam leak site, accessible at the time via an IP address tracked by ransomware.live, presents the Beit Handesai incident as a completed ransomware operation. It explicitly lists the compromised data categories: names paired with Israeli identity numbers, telephone numbers, email addresses, physical home addresses, and scanned passport documents. The posting does not specify the exact number of unique records beyond the rounded claim of more than 60,000 affected individuals and their companions, nor does it provide samples of the stolen material. The disclosure indicates the attackers obtained the files through a ransomware attack and later declared the data destroyed once their demands were presumably met or the operation concluded.

January 15, 2024 marks the first public appearance of the listing. No separate victim notification from Beit Handesai has surfaced in public records, leaving the precise scale and full contents of the exfiltrated material unconfirmed by the company itself.

Why This Matters for You and Your Family

When an engineering company holding government-related or infrastructure contracts is breached, the personal records of employees, contractors, clients, and their family members often travel with project documentation. If your name, Israeli ID number, home address, phone, email, or passport copy sat in Beit Handesai’s systems, those details may now be in the hands of a ransomware operator. That combination of data allows criminals to impersonate you with tax authorities, open accounts in your name, or target your household with phishing and vishing attacks that sound legitimate because they already know where you live and who your relatives are.

Israeli residents are especially exposed because national ID numbers function as universal keys across banks, healthcare providers, schools, and government portals. A single leak of this breadth can accelerate identity theft that affects credit, employment background checks, and even eligibility for state benefits for every member of your household.

The Doxxing and Identity-Chain Risk

The exposed dataset creates immediate doxxing chains. An attacker who obtains your name, ID number, and home address can cross-reference it with social-media profiles, children’s school records, or gaming usernames that reuse the same email. Once one account falls, the rest follow. Passport images add another vector: high-resolution copies can be used to forge travel documents or to train facial-recognition tools that track you across public databases. Public reporting on similar incidents shows these chains frequently lead to extortion attempts against the victim or their family members, especially when home addresses and phone numbers are included.

Credential leaks like this one cascade into account takeovers on personal and children’s gaming accounts that often share the same passwords or recovery emails. A teenager’s Roblox or Fortnite credential stolen through a parent’s work breach can expose the entire household’s location history and payment methods within hours.

Malekteam’s Known Track Record

Public reporting attributes malekteam with emerging in late 2022 as a ransomware-as-a-service operator that combines double-extortion tactics with aggressive data leaks. The group has listed victims ranging from healthcare providers to manufacturing firms and local government contractors, typically posting victim data within weeks of initial access. Their playbook usually begins with phishing or exploitation of remote-desktop services, followed by rapid exfiltration of documents before encryption. Once files are safely removed, malekteam demands payment and, if unpaid, publishes samples or full archives on their leak site. The Beit Handesai listing follows this pattern exactly, with the added Hebrew-language branding that suggests the operators monitor Israeli targets specifically.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password you ever used at Beit Handesai or related engineering portals anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces within hours instead of months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data-broker sites and extortion platforms on your behalf.

The speed with which ransomware groups like malekteam move from breach to public listing leaves little room for delay. Treating this incident as a permanent addition to your digital footprint is the safest approach. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage—including children’s gaming accounts—give you and your family the clearest path out of the breach cycle.