glazkov.co.il Listed by darkvault Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out professional services firms that hold concentrated stores of financial and personal records, turning routine client relationships into high-value targets. Against that backdrop, the accounting practice glazkov.co.il appeared on a darkvault leak-site listing dated 13 August 2024, with the group claiming that internal files had been taken during a ransomware attack. Public detail remains limited, yet the listing itself places the firm and its clients inside a familiar pattern of double-extortion pressure that has become routine across the sector.

Because the number of people affected is unknown and the precise contents of the files have not been independently verified, the incident’s full scope is still unclear. What is known is that a ransomware group has publicly asserted control over material belonging to an established Israeli accounting practice—an assertion that, even unconfirmed, carries immediate practical consequences for anyone whose data may have been involved.

Inside the incident

On 13 August 2024 the darkvault ransomware group listed glazkov.co.il among its claimed victims. The group stated that internal files had been exfiltrated as part of a ransomware attack. No further technical details—such as the initial access vector, the encryption timeline, the volume of data removed, or any ransom demand—have been made public. The number of individuals or organisations potentially affected is recorded simply as unknown. At present the listing itself constitutes the sole publicly reported claim; independent confirmation of the breach’s success or of any subsequent data release has not been supplied in the available record.

Inside darkvault

Darkvault operates as a ransomware group that follows the now-standard double-extortion model: systems are encrypted while copies of data are simultaneously removed, after which the group threatens public release unless payment is made. Victims are routinely advertised on dedicated leak sites, a tactic designed both to apply pressure and to advertise the group’s activity to other potential targets. Darkvault has previously listed organisations across multiple sectors, typically publishing sample files or directory listings to substantiate its claims. In the present case the group asserts that it holds internal files belonging to glazkov.co.il; that assertion remains an unverified claim pending any independent corroboration or further disclosure by the group itself.

About glazkov.co.il

Glazkov.co.il is an accounting firm established in 2012. According to its own description, the practice provides accounting, payroll and tax-planning services to a regular clientele of businesses and individuals. It is led by founder Irena Glazkov, CPA, together with a team of professionals. Firms of this type routinely process sensitive financial statements, tax returns, payroll records, bank details and personal identification data belonging both to corporate clients and to private individuals. A successful intrusion therefore places at risk not only the firm’s own operational information but also the confidential records of every client whose files were stored or processed on the compromised systems. Because accounting practices serve as trusted custodians of financial identity, any confirmed or claimed breach carries consequences that extend well beyond the organisation’s immediate perimeter.

What data was at risk

The only data category named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of specific document types, file counts or data subjects has been released. Organisations that deliver accounting, payroll and tax services typically hold client tax filings, payroll registers, bank-account details, national identification numbers, correspondence with tax authorities and internal working papers. Whether any or all of those categories were among the files claimed by darkvault remains unconfirmed. Until a fuller disclosure appears, the precise contents of the material said to have been taken cannot be stated as fact.

What's at stake

For individuals and businesses whose records may have been included, the principal risks are identity theft, fraudulent tax filings, unauthorised access to bank accounts and targeted social-engineering attempts that exploit knowledge of payroll or tax details. Even partial exposure of financial identifiers can enable long-running fraud that is difficult to reverse. For the firm itself, the consequences include potential regulatory scrutiny, loss of client confidence and the operational cost of forensic investigation and system recovery. Because the number of affected parties is unknown, the scale of these risks cannot yet be quantified; the mere existence of the claim, however, is sufficient to warrant caution on the part of anyone who has entrusted financial data to the practice.

What to do if you're exposed

Anyone who has used glazkov.co.il for accounting, payroll or tax services should treat the listing as a prompt to review recent account statements, tax correspondence and credit reports for unexplained activity. Change passwords on any related online portals, enable multi-factor authentication where available, and consider placing fraud alerts with credit-reference agencies. Monitor communications for phishing messages that reference tax or payroll details. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional, independent signal of whether personal information has circulated beyond this single incident.

AICompiled with AI assistance from public sources and published under our editorial standards.