Doctorim Listed by malekteam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have used Doctorim, an online medical platform serving patients in Israel, may now face questions about the safety of their personal and health-related information. On 5 April 2024 the ransomware group malekteam publicly listed the organisation, claiming it had carried out a successful attack, taken internal files and obtained records covering more than 1.2 million individuals and their companions. The number of people actually affected remains unknown, and independent confirmation of the group’s assertions has not been published. For anyone whose name, identity number or contact details may have been stored by the service, the practical stakes are clear: exposure of such data can enable identity misuse, targeted fraud or unwanted contact long after the initial incident.

What is known so far rests largely on the group’s own leak-site posting. That claim must be treated as unverified until further evidence appears. Even so, the mere listing of a medical platform raises immediate concerns for patients, family members and anyone whose details were held in Doctorim’s systems.

Breaking down the breach

According to the public listing dated 5 April 2024, malekteam asserts that it attacked Doctorim, described in the post as the online medical site operating in Israel under the Hebrew name “דוקתורים”. The group states that the attack was successful, that internal files were exfiltrated, and that it obtained information belonging to more than 1 200 000 persons and companions. It further claims the data include verified names, identity numbers, contact numbers, emails and phones, among other items, and that it destroyed all data on the victim’s systems. No independent verification of these figures, the precise method of intrusion, or the destruction claim has been released. The only confirmed public detail is that malekteam listed Doctorim and characterised the incident as a ransomware attack involving exfiltration of internal files. Scale, exact timing of the intrusion, and technical vectors remain undisclosed.

The group behind it: malekteam

malekteam is a ransomware operation that has appeared on public leak sites in recent years. Like many such groups, it typically claims to encrypt victim systems, exfiltrate data beforehand, and then threaten or carry out publication of the stolen material if a ransom is not paid. Listings often include dramatic language and assertions about the volume and sensitivity of the data taken. The group’s post about Doctorim follows this pattern: it presents the attack as successful, lists categories of personal information, and states that the data were destroyed. These statements are claims made by the actors themselves; they have not been independently corroborated in open sources. malekteam’s earlier activity has generally involved similar leak-site announcements against organisations in various sectors, using the dual threat of encryption and data exposure to pressure victims. No additional statements specific to Doctorim beyond the April 2024 listing have been reported.

About Doctorim

Doctorim operates as an online medical service in Israel, providing digital access to healthcare-related functions for patients and their companions. Organisations of this type commonly maintain records that link personal identifiers with contact details, appointment or service histories, and sometimes limited clinical or administrative information. Because the platform sits at the intersection of personal identity and healthcare, a breach carries heightened consequences: medical-related data are regulated under privacy and health-information rules in many jurisdictions, and their compromise can affect both individuals and the trust placed in digital health services. Public detail about Doctorim’s exact size, infrastructure or security posture is limited; the organisation’s listing by a ransomware group is therefore significant primarily because of the sector it serves rather than any established finding of fault.

The information in question

The only data type named in the available record is “internal files exfiltrated in a ransomware attack.” malekteam’s own posting expands on this claim, asserting that the material covers more than 1.2 million persons and companions and includes verified names, identity numbers, contact numbers, emails, phones and additional unspecified items. These categories remain unverified claims. Organisations operating online medical platforms typically hold patient and companion identifiers, telephone and email addresses, and administrative records necessary to deliver services. Whether any of those categories were in fact taken, and in what volume, has not been confirmed by independent sources. The exact contents of the alleged exfiltration are therefore unconfirmed.

The real-world impact

If the claimed data were obtained, affected individuals could face risks of identity fraud, SIM-swap attempts, phishing that references real personal details, or unwanted contact. Israeli identity numbers and verified contact information are particularly useful to criminals for opening accounts or social-engineering further access. For Doctorim itself, the incident—if substantiated—would raise questions of regulatory notification, potential liability under data-protection rules, and the need to restore or rebuild systems after any claimed destruction of data. Even without confirmation of the full scope, the public listing alone can erode patient confidence and prompt inquiries from users and authorities. No confirmed reports of widespread misuse linked specifically to this listing have been published, yet the combination of medical-sector data and identity numbers keeps the potential for harm concrete rather than theoretical.

If your data was in this claimed breach

Anyone who has registered with or used Doctorim should treat the possibility of exposure seriously until more is known. Practical first steps include monitoring bank and credit accounts for unusual activity, enabling multi-factor authentication on email and other critical services, and being alert to phishing messages that appear to know personal details. Changing passwords associated with the platform and reviewing privacy settings where available are also prudent. Because the precise list of affected individuals has not been released, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Staying informed through official channels from Doctorim or relevant Israeli authorities remains the most reliable way to learn of any confirmed notifications or recommended actions.

AICompiled with AI assistance from public sources and published under our editorial standards.