hanan-hov.co.il Listed by safepay Ransomware Group

On August 03, 2026, the ransomware group Safepay listed hanan-hov.co.il on its leak site, claiming the Israeli logistics company had been hit by a ransomware attack and that internal files had been exfiltrated. The company, headquartered in Neve Yamin, has not publicly confirmed the incident as of this writing, making the claim unverified by any official notification or regulatory filing.

Details from the Leak-Site Listing

The Safepay leak site states that it obtained internal files from hanan-hov.co.il during a ransomware operation. The listing does not specify the volume of data taken, the exact types of documents involved, or the number of individuals whose information may be contained in the files. It also does not disclose any ransom demand or deadline. According to the posting, the data was exfiltrated prior to encryption, a standard ransomware tactic. Because the primary disclosure comes solely from the threat actor’s own leak site via ransomware.live, these details remain an unconfirmed claim rather than an established breach notification.

Why This Matters for You and Your Family

When a logistics company that supports construction, infrastructure, industrial, and commercial projects is targeted, the stolen files can easily contain names, addresses, phone numbers, national ID numbers, contract details, or payment records of customers, suppliers, and employees. Even if you have never directly done business with hanan-hov.co.il, your information may still appear if you or your family members have worked on a related project, supplied materials, or been listed as a contact. Internal files exfiltrated in a ransomware attack often include spreadsheets and PDFs that attackers can parse for personal data within hours. This puts ordinary people at risk of identity theft, phishing campaigns, and financial fraud long after the initial listing.

Doxxing and Identity-Chain Risks

Leaked internal documents frequently create doxxing chains. A home address listed in a vendor file can be cross-referenced with children’s gaming accounts, social-media handles, or school records. Once attackers link an email or phone number to a physical location, they can target your entire household. Credential leaks from such incidents also cascade into account takeovers on unrelated services. Public reporting on ransomware groups shows that data sold or published on leak sites is routinely reused in follow-on attacks months or years later. Gaming accounts belonging to you or your children are especially vulnerable because usernames and passwords reused from work or vendor portals provide an easy entry point for attackers.

Safepay Ransomware Group Track Record

Public reporting attributes Safepay with emerging in late 2025 as a double-extortion operation. The group typically gains initial access through phishing or exploited remote desktop services, exfiltrates sensitive files before deploying ransomware, and then pressures victims by publishing samples on its Tor leak site. Notable prior victims include mid-sized companies in manufacturing, logistics, and professional services sectors. Like many contemporary ransomware actors, Safepay combines data theft with encryption and uses the public leak site both to prove possession of data and to shame non-paying victims. Its playbook relies on the assumption that most organizations will pay to avoid reputational damage and regulatory exposure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, followed by no-subscription cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next time your data appears it is caught and acted on within hours rather than months.
• Rotate any password you have ever used in connection with hanan-hov.co.il or its partners, and secure every account with 2FA through an authenticator app rather than SMS.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf, removing your information from circulation where possible.
• Note that a leaked home address from internal files can expose everyone living at that location; your own timely removal action is what reduces that risk for the household.

The incident underscores how quickly vendor and supplier data can place ordinary families in the crosshairs of ransomware operators. Staying ahead requires more than reactive checks; it demands ongoing visibility and expert intervention. DoxxScan by GalaxyWarden delivers exactly that through continuous monitoring across billions of breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who know how these extortion campaigns actually operate. Source: Safepay leak site listing (via ransomware.live)