ZIV Hospital Listed by malekteam Ransomware Group

On December 24, 2023, the ZIV medical center in Safed, northern Israel, appeared on the leak site of the malekteam ransomware group. The listing claims the attackers exfiltrated internal files containing information on more than 300,000 patients and companions, including names, identity numbers, contact details, disease types, medications, genetic codes, DNA, RNA sequences, and additional sensitive medical data.

Details from the Leak-Site Listing

The malekteam leak page states that ZIV Hospital was compromised in a ransomware attack and that the group successfully exfiltrated internal documents. The disclosure lists specific categories of stolen information: names paired with Israeli identity numbers, phone numbers, email addresses, medical diagnoses, prescribed drugs, and highly sensitive genetic material such as DNA and RNA sequences. The listing does not specify the exact number of records beyond the claim of more than 300,000 affected patients and companions, nor does it provide samples or a full data dump at the time of initial publication. It presents the breach as completed extortion material now published because the hospital did not meet the group's demands.

December 24, 2023 marks the first public appearance of the ZIV listing on the malekteam site, which is tracked via ransomware.live at the address http://195.14.123.2/ziv.html.

Why This Matters for You and Your Family

When a hospital suffers a breach of this scale, the people whose records are exposed are ordinary patients and their families. Medical data is among the most intimate information that exists about you. A leak that includes both your identity numbers and genetic sequences creates lifelong privacy risks that go far beyond typical username-and-password exposures. If you or any member of your family has ever received treatment at ZIV Medical Center in Safed, your full medical history, contact information, and biological identifiers may now sit in an attacker-controlled archive. The disclosure indicates the data was taken during a ransomware incident, meaning the attackers had broad access to internal systems before exfiltration.

The Doxxing and Identity-Chain Risks

Medical records tie your real name, national ID, address-linked phone numbers, and genetic profile together in one package. Once published or sold on underground forums, this information becomes raw material for identity thieves, insurance fraud, blackmail, and doxxing campaigns. Genetic data in particular can be cross-referenced with consumer DNA databases or used to infer family relationships, creating multi-generational exposure. Credential leaks that often accompany ransomware incidents can also cascade into gaming account takeovers, especially for children whose parent accounts share the same email or phone number listed in the stolen hospital files. These chains turn a single breach into repeated harassment across social media, online games, and financial services.

Malekteam's Known Track Record

Public reporting attributes malekteam as a ransomware and extortion operation that emerged in 2023 and focuses primarily on Israeli targets. The group typically gains initial access through common vectors such as phishing or unpatched remote desktop services, exfiltrates sensitive files before encrypting systems, and then runs a double-extortion campaign: demanding payment to prevent data publication and further threatening to contact victims' clients or patients. Notable prior victims listed on their leak site have included other Israeli healthcare providers, schools, and small-to-medium businesses. Their playbook relies on public shaming via clear-web leak sites rather than sophisticated dark-web marketplaces, and they frequently exaggerate the sensitivity of stolen data to increase pressure. The ZIV Hospital listing follows this exact pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, using cleanup handled by GalaxyWarden specialists.
• Rotate any password you ever used at ZIV Hospital or any Israeli medical provider and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that can be reached through the same breached contact details.
• Let remediation specialists perform hands-on takedown requests for any resurfaced medical or genetic data across data brokers and leak forums.

The ZIV breach demonstrates how quickly hospital records can move from protected health systems to public extortion listings. Protecting yourself and your family requires more than changing a password; it demands ongoing visibility into where your information surfaces and professional help to remove it. DoxxScan by GalaxyWarden delivers exactly that: continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including coverage for your household and children's gaming accounts that often become targets once medical contact details are exposed.