core.touch-ins.co.il Listed by toufan Ransomware Group

On December 19, 2023, the domain core.touch-ins.co.il appeared on the leak site operated by the toufan ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the Israeli insurance-services provider. The group claims to have stolen company data and is using the public posting to pressure the victim, although the exact volume of records and the specific types of information taken remain undisclosed in the listing.

Reported Details from the Leak

The toufan leak site entry states that core.touch-ins.co.il was listed on December 19, 2023, and explicitly states that internal files were exfiltrated in a ransomware incident. No customer record count is provided, nor does the posting itemize the contents of the stolen data. The disclosure indicates the data is now held by the attackers and may be released or sold if their demands are not met. Ransomware.live mirrors the listing at the URL below, preserving the original claim that a successful breach and data theft occurred.

Why This Matters for You and Your Family

When an insurance-services company loses control of internal files, the people whose policies, claims, or personal details sit inside those systems face direct exposure. Even without an exact headcount, the breach affects anyone who has interacted with Touch Insurance services in Israel. Your name, address, national ID, policy numbers, banking coordinates, or medical information tied to claims could be sitting in the attackers’ archive. Once that material surfaces on criminal forums, it becomes raw material for identity theft, loan fraud, and targeted phishing that can reach you or your spouse at home.

Insurance data is especially valuable because it often links multiple family members, dependents, and financial accounts in one place. A single exposed policy file can reveal your children’s names and birth dates alongside your home address and payment history. Criminals treat such packages as starter kits for long-term fraud campaigns that can damage credit scores and create tax complications months or years later.

The Doxxing and Identity-Chain Risk

Ransomware leaks rarely stop at one company dataset. The stolen files almost certainly contain email addresses, usernames, or internal handles that attackers can cross-reference with other breaches. Those links create identity chains: an email from the insurance breach can be matched to a gaming account, a social-media profile, or a password reset token on another service. The result is doxxing that moves from corporate data to personal life in hours. Gaming accounts belonging to your children are frequent secondary targets because the same email and password combinations are often reused, turning one corporate breach into a household compromise.

Toufan Ransomware Group Track Record

Public reporting attributes Toufan’s first notable appearances to mid-2023. The group operates a double-extortion model: it encrypts victim networks and simultaneously exfiltrates data before demanding payment to prevent publication. Prior victims have included mid-sized organizations across the Middle East and Europe, many in sectors that handle personal or financial records. Typical playbook begins with phishing or exploited remote-access tools for initial entry, followed by rapid lateral movement, data archiving, and then public shaming on their leak site when negotiations stall. The group’s listings usually surface between four and eight weeks after initial compromise, consistent with the timeline suggested by this December 19 posting.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at Touch Insurance or related services anywhere it is reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests across data-broker sites and leak forums on your behalf.

The incident shows how quickly corporate ransomware leaks become personal identity problems. A single listing can kick off months of opportunistic crime against you and your family. Starting with structured monitoring and cleanup gives you the earliest possible warning and the most practical path to containment. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk of takeover from credential leaks like this one.