gav.co.il Listed by malekteam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organizations of many sizes, often claiming network access, data theft and partial destruction as leverage. Listings on leak sites have become a routine part of that landscape, even when independent confirmation remains limited. Against that backdrop, the December 2023 listing of gav.co.il by the group known as malekteam fits a familiar pattern of claimed intrusion and data handling.

Public reporting indicates that gav.co.il was listed by malekteam on or around 24 December 2023. The group asserted that it had infiltrated the site’s network, exfiltrated material it described as useful, and deleted a portion of the remaining data. The number of people affected is unknown, and independent verification of the full scope has not been detailed in the available record. The incident matters because any exposure of internal files can create lasting risks for individuals and for the organisation itself.

Inside the incident

According to the listing attributed to malekteam, the group claimed to have gained access to the network system of gav.co.il, transferred selected data, and then deleted part of the existing information. The group further stated that roughly 10 terabytes of material was destroyed because the volume and time required made full transfer impractical. The reported summary characterises the activity as a ransomware-style attack involving exfiltration of internal files. Exact timing of the intrusion, the technical method used, and the total volume of data successfully removed remain undisclosed beyond the group’s own statements. No confirmed figure for affected individuals has been published.

The listing itself constitutes a claim by the threat actor rather than independently verified proof. Public detail on whether negotiations occurred, whether a ransom was demanded or paid, or whether systems were restored is limited.

Who is malekteam?

Malekteam is a ransomware group that has appeared on public leak sites, typically announcing victims after claiming network compromise and data theft. Like many such actors, it commonly asserts that it has exfiltrated files and may threaten or carry out partial deletion or public release to increase pressure. Its operations follow the double-extortion model seen across the ransomware ecosystem: access, theft, and then leverage through claimed destruction or publication. Prior activity associated with the name has involved listings of various organisations, though specifics of any single campaign are usually known only through the group’s own posts and subsequent reporting. In this case, statements about gav.co.il are presented as the group’s claims and have not been independently confirmed in the available facts.

gav.co.il and its sector

gav.co.il is an organisation operating under an Israeli country-code domain. Public background on its precise business lines is limited in the breach record, yet entities of this type commonly manage operational, administrative and project-related information. Organisations in similar positions often hold identity records, financial documentation, administrative files and details of ongoing work. A breach affecting such material can therefore touch both internal operations and any individuals whose data appear in those systems. The consequential nature of the incident stems from the potential sensitivity of the claimed file categories rather than from any public finding of organisational fault.

What data was at risk

The facts describe the exposure as internal files exfiltrated in a ransomware attack. Malekteam’s listing specifically claims that the transferred material included identity information and identification documents, a large volume of financial and administrative files and documents, and information and details of projects. The group also stated that approximately 10 terabytes of additional sensitive site information was deleted and destroyed. Exact contents, file counts and the identities of any affected individuals remain unconfirmed beyond these claims. Organisations of this kind typically hold personnel or client identity data, financial records, administrative correspondence and project documentation; whether those categories match the actual holdings of gav.co.il cannot be verified from the public record alone.

Why it matters

If identity documents or personal details were among the files taken, individuals could face elevated risks of identity misuse, targeted phishing or social-engineering attempts that reference real project or administrative information. Financial and administrative files, if authentic, could expose payment details, contracts or internal processes that adversaries might exploit for further fraud. For the organisation, loss or destruction of project data and operational files can disrupt continuity, require costly reconstruction and damage trust with partners or clients. Because the number of people affected is unknown and the precise data set is unconfirmed, the practical impact remains a matter of prudent caution rather than established scale. The combination of claimed exfiltration and partial deletion also means that recovery may be incomplete even if systems are restored.

What to do if you're exposed

Anyone who has had dealings with gav.co.il or believes their information may have been held by the organisation should treat the listing as a prompt for basic hygiene rather than confirmed personal compromise. Monitor financial accounts and credit reports for unexpected activity, enable multi-factor authentication on important accounts, and be alert to phishing messages that reference identity documents, projects or administrative matters. Change passwords on any accounts that may have shared credentials with systems linked to the organisation. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. If identity documents are believed to be involved, consider contacting relevant authorities or credit-monitoring services for additional protective steps. Public detail on this incident remains limited; further official statements from the organisation, if any, would provide clearer guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.