emalon.co.il Listed by malekteam Ransomware Group

On April 05, 2024, the ransomware group Malek Team listed Israeli travel website emalon.co.il on its leak site, claiming it had exfiltrated internal files during a ransomware attack and subsequently destroyed all data on the victim’s systems.

Primary Disclosure Details

The Malek Team leak site states that it fully compromised emalon.co.il, an Israeli travel booking platform. The listing asserts that internal files were exfiltrated before the attackers destroyed all data on the company’s systems. No specific number of affected records is provided, and the disclosure does not detail the exact types of documents taken. The site uses inflammatory language claiming “MALEK TEAM has everything” and that the data destruction was intentional. The primary source remains the group’s own leak page, accessible via mirrors tracked by ransomware.live at http://195.14.123.2/.

Why This Matters for You and Your Family

When a travel website is breached, the personal information customers provided for bookings — names, addresses, passport numbers, phone numbers, email addresses, and payment details — can end up in criminal hands. Even though the exact volume of records is unknown, any family that booked flights, hotels, or tours through emalon.co.il since the site launched may have their details exposed. Travel data is especially dangerous because it often links multiple family members, includes dates of travel that reveal when homes are empty, and contains identity documents that can be used for fraud or impersonation. The attackers’ claim that they destroyed the original systems means the company may no longer possess clean backups, increasing the chance that stolen copies become the only remaining version of your information.

Doxxing and Identity-Chain Risks

Travel-site breaches frequently serve as the starting point for larger doxxing chains. A single email or phone number allegedly taken from emalon.co.il can be cross-referenced with gaming accounts, social-media handles, and family photos to build a complete profile. Public reporting on similar incidents shows that once attackers link an address to travel history, they can predict vacant periods for physical threats or targeted phishing. Children’s information is sometimes included when family bookings list minors’ dates of birth or passport details; these records can later surface in gaming-platform leaks, enabling account takeovers that expose chat logs, friend lists, and further personal data. The result is an expanding web of linked identities that criminals sell or exploit over months or years.

Malek Team’s Known Track Record

Public reporting attributes the first significant activity by Malek Team to late 2023, when the group began targeting Israeli organizations with ransomware and data-destruction tactics. The group has listed multiple Israeli websites and companies, often combining encryption with public shaming that emphasizes national targeting. Their typical playbook involves initial access through phishing or unpatched web vulnerabilities, followed by exfiltration of internal documents, deployment of ransomware, and then dual extortion: demanding payment while threatening to publish stolen files and, in some cases, destroying systems to eliminate recovery options. The April 2024 emalon.co.il listing fits this pattern exactly, with the added theatrical language intended to pressure both the victim and the wider Israeli online community.

What to do

• Run a DoxxScan to map every link between your email, phone, travel booking accounts, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate any password you used on emalon.co.il or any other travel site and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after travel data leaks.
• Let remediation specialists handle data-broker takedown requests and follow-up notifications on your behalf while you focus on securing day-to-day accounts.

The emalon.co.il breach is a reminder that even mid-sized travel sites can become gateways to long-term identity compromise when ransomware groups treat customer data as both leverage and inventory. Starting protective steps now limits how far criminals can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that often follow breaches like this one.