dorimedia Listed by malekteam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 24, 2023, the organisation dorimedia, also referred to as Dori Media Group, was listed by the ransomware group malekteam. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and many operational details have not been confirmed independently.

The listing itself is a claim by the group. Malekteam stated it had destroyed more than 100 TB of data belonging to the company and said it would leak information soon. For individuals and partners connected to a media group that operates across several countries, the incident raises questions about what internal material may have left the organisation’s control.

Breaking down the breach

According to the available record, dorimedia was listed by malekteam on December 24, 2023. The reported summary characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. The group’s own statement claimed destruction of more than 100 TB of data and described the organisation as Dori Media Group LTD, an international media company with presence in Israel, Switzerland, Argentina, Spain and Singapore. It further asserted that the group produces and distributes television and new-media content, broadcasts channels and operates video-content internet sites, noting activity since 1998, and warned that further information would be leaked.

No independent confirmation of the volume of data destroyed, the precise method of intrusion, the duration of access, or the full inventory of taken files has been supplied in the public facts. The number of individuals whose information may have been involved is listed as unknown. Timing beyond the report date of December 24, 2023, and any ransom demand or payment status remain undisclosed.

Inside malekteam

Malekteam is a ransomware group that has appeared on public leak sites used by such actors. Groups of this type typically gain unauthorised access to networks, exfiltrate data, encrypt systems, and then post victim names on dedicated leak sites while threatening to publish or sell the stolen material if demands are not met. Their operations often combine double-extortion tactics—encryption plus data theft—with public claims intended to increase pressure.

In this case the group claims to have listed dorimedia, to have destroyed more than 100 TB of the company’s data, and to intend a future leak. Those statements should be treated as unverified claims originating from the actors themselves rather than as independently established facts. No additional specific assertions by malekteam about this victim beyond the listing and the quoted summary appear in the available record.

dorimedia and its sector

Dori Media Group is described in the group’s own post as an international cluster of media companies headquartered or operating in Israel, Switzerland, Argentina, Spain and Singapore. It produces and distributes television and new-media content, broadcasts various channels and runs video-content internet sites, with a history dating back to 1998. Organisations of this kind sit at the intersection of content production, distribution, broadcasting rights and digital platforms.

Media groups routinely handle scripts, production schedules, commercial contracts, employee and contractor records, partner and advertiser information, and technical or financial documentation related to rights and distribution. A breach affecting such an entity can therefore touch both creative and business-sensitive material as well as personal data belonging to staff, freelancers and commercial contacts. Because the company operates across multiple jurisdictions, any confirmed compromise may also raise cross-border regulatory and contractual questions.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, named databases or specific personal-data fields has been disclosed. The group claimed destruction of more than 100 TB of data and said it would leak “all this information soon,” but those assertions remain unconfirmed by independent sources.

Organisations in the media and content sector typically hold a mix of internal business documents, production materials, human-resources records, commercial agreements and technical or financial files. Whether any of those categories were among the material taken in this incident is unconfirmed. The exact contents of the exfiltrated files, and whether personal data of employees, partners or customers were included, are therefore unknown at present.

Why it matters

For people whose information may have been held by dorimedia—employees, freelancers, contractors or commercial partners—the primary risks are identity-related misuse, targeted phishing that leverages internal knowledge, and potential exposure of contact or contractual details. Even purely internal business files can enable social-engineering attacks if they reveal organisational structure, project names or relationships.

For the organisation itself, the consequences can include operational disruption from any encryption that accompanied the exfiltration, reputational damage, contractual liabilities toward partners and rights holders, and the need to investigate and remediate systems across multiple countries. Because the scale of personal data involved is listed as unknown, the full human impact cannot yet be quantified. The group’s claim of large-scale data destruction, if accurate, would also imply significant recovery and continuity challenges.

If your data was in this claimed breach

If you have a past or present relationship with dorimedia or Dori Media Group, treat the possibility of exposure seriously even while exact contents remain unconfirmed. Practical first steps include:

• Monitor financial and email accounts for unusual activity and enable multi-factor authentication where available.
• Be alert to phishing or social-engineering messages that reference media projects, contracts or internal contacts.
• Change passwords on any accounts that may have shared credentials or recovery details with work systems, and avoid reusing passwords.
• Request information from the organisation about whether your personal data was among the material involved, once official notifications are issued.
• Consider placing fraud alerts with relevant credit or identity services if you believe sensitive personal identifiers could have been held.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Stay attentive to any official statements from the company rather than relying solely on claims made by the threat actors.

AICompiled with AI assistance from public sources and published under our editorial standards.