emalon.co.il Listed by malekteam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who used emalon.co.il for travel arrangements may now face uncertainty about whether their personal details, booking records or related files have been taken and could be misused. Public information about the incident remains limited, yet the listing of the site by a ransomware group raises clear practical stakes for anyone whose data the company held.

On 5 April 2024 the organisation emalon.co.il was reported as listed by the malekteam ransomware group. The group claims it recently hacked the Israeli travelling site, exfiltrated internal files and destroyed all data. The number of people affected is unknown, and independent confirmation of the full scope has not been published.

What happened

According to the reported listing, malekteam stated that it had carried out a cyber attack against emalon.co.il, described as a travelling site (אימלון in Hebrew). The group claimed it exfiltrated internal files in a ransomware attack, that it “has everything,” and that it destroyed all data. The report is dated 5 April 2024. No further public detail has been released on the precise method of intrusion, the volume of data taken, the exact date of the intrusion itself, or any ransom demand. The number of individuals whose information may be involved remains unknown. The listing itself constitutes a claim by the group rather than independently verified confirmation of every asserted detail.

Who is malekteam?

malekteam is a ransomware group that has publicly listed multiple organisations on leak-style sites, typically claiming both data theft and encryption or destruction of systems. Like other ransomware actors of this type, the group commonly advertises victims after an intrusion, asserts that internal files have been exfiltrated, and sometimes threatens or claims further release or destruction of data. Public reporting on the group’s prior activity shows a pattern of targeting organisations across different sectors and geographies, often with short, dramatic announcements that emphasise complete control over the victim’s data. In this case the group’s statements about emalon.co.il—that it hacked the site, holds everything and destroyed all data—must be treated as claims made on its listing rather than established facts beyond the reported summary.

emalon.co.il and its sector

emalon.co.il operated as a travelling site serving customers, primarily in Israel. Organisations of this kind typically maintain customer contact details, booking and itinerary records, payment-related information, and internal operational files needed to manage reservations and supplier relationships. A breach affecting such a site is consequential because travel data often combines identity information with travel plans, dates and locations, which can be useful for identity fraud, phishing or social-engineering attacks. The reported listing therefore carries weight for both the organisation’s operations and the individuals who interacted with it, even though the precise scale of any compromise remains undisclosed.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The group further claims it has everything and destroyed all data. Exact data types beyond “internal files” have not been itemised in the public report, and the number of people affected is unknown. Travel-sector organisations commonly hold names, contact details, booking histories, passport or identity references, payment tokens or invoices, and internal correspondence. Because the precise contents of the claimed exfiltration have not been independently detailed, it is not possible to confirm which specific categories were taken. Readers should therefore treat the exposure as involving internal files whose full composition remains unconfirmed.

Why it matters

For individuals, the real-world risk centres on the possible misuse of personal and travel-related information. Even limited internal files can enable targeted phishing, account-takeover attempts or identity fraud if names, emails, phone numbers or booking details are present. For the organisation, the claimed destruction of data and the public listing create operational disruption, potential regulatory scrutiny and loss of customer trust. Because the number of affected people is unknown and the exact data set is unconfirmed, the practical impact cannot yet be quantified, yet the combination of claimed exfiltration and data destruction is sufficient to warrant caution among anyone who used the site.

If your data was in this claimed breach

If you believe your information may have been held by emalon.co.il, take the following measured steps:

• Monitor bank and card statements for unfamiliar charges and enable transaction alerts where available.
• Change passwords on any accounts that reused credentials linked to the travel site, and enable multi-factor authentication.
• Treat unsolicited emails or messages that reference past bookings or travel plans with heightened suspicion; verify through official channels before clicking links or supplying further data.
• Consider placing a fraud alert with relevant credit-reference services if you are concerned about identity misuse.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets.

Public detail on this incident remains limited. Continued monitoring of official statements from the organisation or relevant authorities is advisable as further information may emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.