CyberServe Data Breach (2021): What Was Exposed & What To Do

In October 2021, the Israeli hosting provider CyberServe was breached. A substantial volume of customer data was subsequently leaked publicly. The incident was reported on 29 October 2021 and is understood to have affected 1.1 million people. Data from multiple hosted sites, including the LGBTQ dating platform Atraf and the Machon Mor medical institute, appeared in the leak. The exposed records contained a wide mix of personal details because the provider hosted services with differing purposes. Passwords stored in plain text were also reported among the material. The dataset was later contributed to Have I Been Pwned with assistance from May Brooks-Kempler.

Inside the incident

CyberServe, an Israeli hosting provider, experienced a breach in October 2021 that led to the public release of customer data. The material was made available online after the organisation was ransomed. The leak included records from several distinct sites hosted by the company, resulting in a broad collection of information rather than a single uniform dataset.

Public reporting on 29 October 2021 placed the number of affected individuals at 1.1 million. Specific details on the initial access method, the exact volume of files taken, or the timeline between intrusion and ransom demand have not been disclosed in available information. The data was attributed in public statements to a group known as Black Shadow.

How a breach like this happens

Incidents involving hosting providers often begin with unauthorised access to shared infrastructure that supports multiple client websites. Attackers may exploit vulnerabilities in web applications, server configurations, or administrative interfaces to reach stored customer records.

Once inside, threat actors can copy large volumes of data. When ransom demands are not met, the material is sometimes published on leak sites. Because a single provider may host services in different sectors, the resulting dataset can contain unrelated categories of personal information collected for separate purposes.

Who is CyberServe?

CyberServe operated as a hosting provider in Israel. Companies in this sector supply the servers, storage, and connectivity that allow other organisations to run websites and online services. As a result, they routinely process account details, configuration data, and content belonging to their clients’ users.

A breach at such a provider is consequential because the same infrastructure can hold records from unrelated services, including commercial platforms and medical organisations. The diversity of hosted clients increases the range of data types that may be exposed in a single event.

The information in question

The published material included dates of birth, drinking habits, email addresses, family structure, genders, geographic locations, HIV statuses, and IP addresses. Additional records referenced relationship information and medical data associated with the affected sites.

Passwords stored in plain text were also reported. The precise scope of every field contained in the full dataset remains unconfirmed beyond these categories, and the exact contents held by each individual hosted service have not been itemised publicly.

What's at stake

Exposure of HIV statuses, medical information, and relationship details can create lasting privacy risks for the individuals concerned. Email addresses combined with plain-text passwords increase the chance of account takeovers on other services where the same credentials were reused.

For the organisation, the incident highlights the downstream effects of hosting multiple clients with sensitive data on shared systems. Affected people may face follow-on fraud attempts or unwanted disclosure of personal circumstances, while the provider faces operational and reputational consequences from the loss of customer trust.

If your data was in this breach

Individuals can begin by changing passwords on any accounts that used the same credentials listed in the incident, prioritising email and financial services. Enabling multi-factor authentication on those accounts reduces the value of exposed passwords to attackers.

Monitoring incoming email and financial statements for unusual activity provides an early indication of misuse. Readers can also run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.