Israel MOD and Benny Gantz Listed by mosesstaff Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Israel MOD and Benny Gantz Listed by mosesstaff Ransomware Group (reported December 18, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
The Israel Ministry of Defense, associated with then-Defense Minister Benny Gantz, appeared on a leak site operated by the ransomware group mosesstaff on 18 December 2021. The listing states that internal files were taken; no confirmed count of records, no list of specific file names, and no independent verification of the data have been made public.
The incident remains limited to the group’s public claim. No details on the method of access, the volume of material, or confirmation that any data was later published have been disclosed.
What happened
On 18 December 2021 the mosesstaff ransomware group added an entry for Israel MOD and Benny Gantz to its leak site. The entry asserts that internal files were exfiltrated during a ransomware operation. No further technical details, timelines, or evidence of the claimed theft have been released by the organization or by investigators.
The number of people affected and the precise contents of any files remain unknown. Public reporting has not confirmed whether data was encrypted, whether ransom demands were issued, or whether any material was subsequently released.
Who is mosesstaff?
Mosesstaff is a ransomware operator that maintains a leak site to publish data it claims to have stolen from victim organizations. The group has been publicly linked to campaigns that combine encryption with the threat of data disclosure. Its targets have frequently included entities in Israel and other countries in the region.
Like other ransomware groups, mosesstaff uses the publication of victim names and sample files as leverage. Any specific claim made on its site about a particular organization is an assertion by the group and is not independently verified unless corroborated by the victim or by law-enforcement findings.
Israel MOD and Benny Gantz and its sector
The Israel Ministry of Defense is the government department responsible for national defense policy, military operations, procurement, and related intelligence activities. Benny Gantz served as Defense Minister at the time of the listing. Organizations in this sector routinely hold planning documents, personnel records, contractor information, and technical data connected to defense systems.
A public claim that files from such an organization have been taken raises questions about the protection of sensitive government information, even when the exact material remains undisclosed.
What was likely exposed
The mosesstaff listing refers only to “internal files.” No inventory of data types, file categories, or record counts has been published. In the absence of Reported Details, the exact contents cannot be stated as fact.
Defense ministries typically maintain records that include employee and contractor information, budgetary documents, operational correspondence, and technical specifications. Whether any of these categories were involved in the claimed incident is unconfirmed.
What's at stake
Exposure of internal defense files can affect operational security, reveal administrative processes, or disclose contact details of personnel and suppliers. The practical consequences depend on the sensitivity of the specific material, which has not been established.
For individuals whose information appears in such files, risks may include targeted phishing or attempts at social engineering. The organization faces the task of assessing and mitigating any operational impact from the claimed access.
What to do if you're exposed
Individuals who believe their information may have been involved should monitor official communications from the Ministry of Defense and follow any guidance it issues. Standard steps include reviewing bank and email accounts for unusual activity and enabling multi-factor authentication where available.
Readers can run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Unit 8200 Listed by mosesstaff Ransomware GroupFirst part of Israel Post data leaked Listed by mosesstaff Ransomware GroupAHEC Tax Solutions Listed by mosesstaff Ransomware GroupV-ON Listed by mosesstaff Ransomware GroupLatest breaches
Publicly posted by mosesstaff — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.