gav.co.il Listed by Malekteam Ransomware Group

On December 24, 2023, Israeli company GAV.co.il appeared on the leak site of the malekteam ransomware group. The listing states that attackers gained network access, exfiltrated data, deleted portions of the company’s information, and posted proof of the breach. The disclosure indicates that the stolen material includes identity information, identification documents, financial and administrative files, project details, and roughly 10 terabytes of additional sensitive records. The exact number of people whose records were taken remains unknown.

Details in the Leak Listing

The malekteam page explicitly claims the attackers first infiltrated GAV’s network, obtained necessary access, transferred “useful data,” and then deleted part of the remaining information. It lists the categories taken as identity information and identification documents, large volumes of financial and administrative files, and project details. The group states that an additional 10 terabytes of material was destroyed because of its size. The primary disclosure does not specify which systems were initially compromised or the precise timeline of the intrusion.

Why This Matters for You and Your Family

When a company that handles personal identity documents and financial records is breached, the information can be used to open accounts, file fraudulent tax returns, or impersonate victims years later. Because the leak involves both identity documents and project-related files, anyone whose data was stored with GAV now faces long-term exposure. Families are affected when one member’s records appear in the same dataset; a parent’s financial file can be cross-referenced with a child’s identification details to build a more complete profile. The malekteam listing makes the material publicly available, so the risk is no longer limited to a single criminal buyer.

Doxxing and Identity-Chain Risks

Identity documents combined with financial and project files create powerful linkage points. A scanned passport or national ID can be matched to an email address, phone number, or physical address found in the administrative documents. Once these links exist, attackers can pivot to social-media accounts, gaming logins, or school portals that reuse the same credentials. Credential leaks like this one cascade into account takeovers and doxxing chains that expose children’s gaming handles tied to the family address. The public nature of the malekteam site accelerates this process because multiple actors can download and correlate the same dataset simultaneously.