gav.co.il Listed by malekteam Ransomware Group

On December 24, 2023, Israeli company GAV.co.il appeared on the leak site of the malekteam ransomware group. The listing states that attackers gained network access, exfiltrated data, deleted portions of the company’s information, and posted proof of the breach. The disclosure indicates that the stolen material includes identity information, identification documents, financial and administrative files, project details, and roughly 10 terabytes of additional sensitive records. The exact number of people whose records were taken remains unknown.

Details in the Leak Listing

The malekteam page explicitly claims the attackers first infiltrated GAV’s network, obtained necessary access, transferred “useful data,” and then deleted part of the remaining information. It lists the categories taken as identity information and identification documents, large volumes of financial and administrative files, and project details. The group states that an additional 10 terabytes of material was destroyed because of its size. The primary disclosure does not specify which systems were initially compromised or the precise timeline of the intrusion.

Why This Matters for You and Your Family

When a company that handles personal identity documents and financial records is breached, the information can be used to open accounts, file fraudulent tax returns, or impersonate victims years later. Because the leak involves both identity documents and project-related files, anyone whose data was stored with GAV now faces long-term exposure. Families are affected when one member’s records appear in the same dataset; a parent’s financial file can be cross-referenced with a child’s identification details to build a more complete profile. The malekteam listing makes the material publicly available, so the risk is no longer limited to a single criminal buyer.

Doxxing and Identity-Chain Risks

Identity documents combined with financial and project files create powerful linkage points. A scanned passport or national ID can be matched to an email address, phone number, or physical address found in the administrative documents. Once these links exist, attackers can pivot to social-media accounts, gaming logins, or school portals that reuse the same credentials. Credential leaks like this one cascade into account takeovers and doxxing chains that expose children’s gaming handles tied to the family address. The public nature of the malekteam site accelerates this process because multiple actors can download and correlate the same dataset simultaneously.

Malekteam’s Known Track Record

Public reporting attributes malekteam with operating a double-extortion model that combines data theft, encryption, and public shaming. The group emerged in late 2022 and has targeted organizations across multiple countries, typically gaining initial access through phishing, remote-desktop vulnerabilities, or compromised credentials. After exfiltration they demand payment to prevent publication; when payment is refused they post samples and eventually the full archive. Their leak site serves both as an extortion platform and a public humiliation tool, a pattern consistent with the GAV listing that shows both stolen file categories and a declaration of partial data destruction.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what malekteam now holds.
• Rotate every password used at GAV.co.il anywhere it is reused and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts chained to the same address or documents.
• Let DoxxScan remediation specialists handle takedown requests and broker removals while you focus on securing your own logins.

The GAV breach is a reminder that even mid-sized service providers can become gateways to long-term identity fraud. One decisive scan and ongoing monitoring can break the chain before criminals complete the picture. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this leak has opened.