lavi.co.il Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 30, 2024, the Israeli organisation operating as lavi.co.il was listed by the ransomware group known as incransom. Public reporting states that internal files were exfiltrated in a ransomware attack, with the group claiming a large volume of material was taken. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

The listing matters because it signals a potential compromise of operational and internal data belonging to a mid-sized Israeli firm. Without further disclosure from the organisation itself, the precise impact on individuals and partners cannot yet be measured, but the claim alone warrants careful attention from anyone connected to the company.

What happened

According to available records, lavi.co.il appeared on incransom’s leak site on December 30, 2024. The group asserts that internal files were exfiltrated as part of a ransomware attack. Public detail on the timing of the intrusion, the initial access method, or any ransom demand is undisclosed. The listing includes a claimed inventory of 119128 files totaling 93,202,615,220 bytes, along with directory information, but these figures originate solely from the threat actor’s post and have not been independently verified. No statement from the organisation confirming or denying the incident has been included in the reported facts.

The group behind it: incransom

Incransom is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like other groups of this type, it maintains a public leak site where it names victims and, in some cases, releases sample files or full archives. Its activity is well-documented across multiple sectors and countries; listings typically appear after the group claims to have completed exfiltration. In this instance the group claims to have taken internal files from lavi.co.il, but that assertion remains an unverified claim pending any confirmation from the victim or independent investigators. No additional statements attributed specifically to this victim beyond the listing itself appear in the available facts.

lavi.co.il and its sector

lavi.co.il is associated with Kibbutz Lavi Hotel, described in reporting as a company operating in the furniture industry, headquartered in Israel, employing between 50 and 99 people, and generating annual revenue in the 10 million to 25 million range. A contact telephone number of +972 46799450 is also listed in the same summary. Organisations of this size and type typically manage guest or customer records, supplier contracts, employee information, financial documents, and operational files related to manufacturing or hospitality services. A breach involving such an entity can affect both commercial partners and individuals whose personal or transactional data may reside in internal systems. Because the company sits at the intersection of hospitality and furniture production, the potential data sets are broader than those of a pure manufacturer or pure hotel operator.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” Exact contents are unconfirmed. Organisations of this profile commonly hold the following categories of material, any of which could be among the claimed files:

• Employee records and internal correspondence
• Customer or guest booking and contact details
• Supplier contracts, invoices, and financial documents
• Operational and production-related files
• Administrative and system configuration data

The threat actor’s listing cites 119128 files and approximately 93 GB of data, yet these numbers and the precise nature of the material remain claims rather than independently audited facts. No further breakdown of data types has been publicly confirmed.

What's at stake

For individuals whose information may be present, the practical risks include possible misuse of contact details, identity-related fraud if personal identifiers were stored, and targeted phishing that leverages knowledge of their relationship with the company. For the organisation itself, the stakes include operational disruption, potential regulatory scrutiny under Israeli data-protection rules, reputational harm with customers and partners, and the cost of investigation and remediation. Because the number of people affected is unknown and the exact data types remain unconfirmed, the full extent of harm cannot yet be quantified. The mere publication of a large file inventory on a leak site already creates uncertainty that can affect trust and day-to-day business relationships.

What to do if you're exposed

Anyone who has had dealings with Kibbutz Lavi Hotel or lavi.co.il should treat the possibility of exposure seriously even while details remain limited. Change passwords associated with any accounts linked to the organisation, enable multi-factor authentication wherever available, and monitor financial and email accounts for unusual activity. Be alert to phishing messages that reference the company or claim to offer breach-related assistance. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If you believe your personal data was held by the organisation, consider placing fraud alerts with relevant credit or identity-protection services and retain records of any suspicious contacts. Official updates from the company, if issued, should be followed for the most accurate guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.