lavi.co.il Listed by incransom Ransomware Group

On December 30, 2024, the Israeli company operating the Kibbutz Lavi Hotel had 119,128 files listed on the leak site of the ransomware group Incransom. The exposed data totals more than 93 GB of internal documents from a business that employs between 50 and 99 people and generates annual revenue between $10 million and $25 million.

What's Publicly Reported from Reporting

Public reporting indicates the incident began as a ransomware attack in which attackers gained access to the company’s network, exfiltrated files, and later published a sample on their dark-web blog. The listing includes a wide range of internal files whose exact contents have not been independently verified by third parties. Available reporting describes the company as a furniture-industry operator headquartered in Israel with the publicly listed phone number +972 46799450. No confirmed count of affected individuals has been released, but the volume and nature of the files suggest employee, customer, supplier, and operational records may be present.

Why This Matters for You and Your Family

When a local business that handles reservations, payments, vendor contracts, or employment records is breached, your personal information can be caught in the net. A hotel stay, a furniture purchase, or a job application can leave behind names, addresses, phone numbers, email accounts, payment details, or identity documents. Once those records leave the company’s control, they can appear on criminal forums and be used for identity theft, phishing, or harassment. Ordinary families who dealt with the Kibbutz Lavi Hotel now face the same downstream risks that larger breaches create, yet they often receive far less public attention or corporate support.

The Doxxing and Identity-Chain Implications

Leaked internal files frequently contain spreadsheets that link names to addresses, phone numbers to email accounts, and customer IDs to booking histories. Attackers and subsequent buyers can combine this information with data from earlier breaches to build detailed profiles. A single exposed hotel record can anchor an identity chain that reveals family members, children’s names, and even gaming usernames tied to the same household email or phone. These chains accelerate doxxing because one confirmed link makes every other exposed handle easier to attribute to a real person. Credential leaks of this type regularly cascade into account takeovers on gaming platforms, social media, and email, turning a corporate breach into a personal privacy emergency for you and your family.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has listed victims across multiple countries and industries, typically posting initial access evidence, followed by samples of exfiltrated data, and then applying pressure through public shaming on their leak site. Their playbook centers on encrypting systems where possible, exfiltrating documents before encryption, and using the threat of full disclosure to encourage payment. Exact success rates and prior victim counts remain difficult to verify, but available reporting describes a pattern of targeting mid-sized organizations whose internal file shares contain sensitive operational and personal data.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you used on lavi.co.il or related Kibbutz Lavi systems anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts and alerting family members.

The incident shows that even mid-sized local businesses can become gateways for identity exposure that reaches your front door. Taking concrete steps now limits how far attackers can travel down the identity chains they are building. DoxxScan by GalaxyWarden delivers continuous monitoring across more than 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects online handles to real-world identities, and hands-on remediation by specialists who manage takedowns on your behalf; its household coverage also protects children’s gaming accounts that frequently become targets once a family link is established.