Magnolia (Israel) Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Magnolia (Israel) has been listed by the MedusaLocker ransomware group after internal files were exfiltrated. The incident was disclosed on 5 May 2026, affecting an undisclosed number of people; individuals should check whether their information was involved and take appropriate protective steps.
A ransomware group has listed an Israeli jewelry company on its leak site, claiming to have stolen internal files during an attack. With the number of people affected still unknown and the full contents of the data unconfirmed, individuals who have done business with the firm have no clear picture yet of whether their information is at risk.
The incident was reported on 5 May 2026. The company in question is Magnolia (Israel), which sells silver and accessories and has taken part in the Vicenza jewelry fair.
Inside the incident
The only public information comes from a listing placed by the medusalocker group. The listing states that internal files were exfiltrated in a ransomware attack and refers to roughly 38,000 files, including invoices prefixed SI, IN and OV written in Hebrew. No confirmation of the listing’s accuracy has been issued by Magnolia, and no details on the timing or method of the intrusion have been released.
The number of individuals whose data may be involved remains undisclosed. No ransom demand, payment, or restoration status has been made public.
Who is medusalocker?
Medusalocker is a ransomware operation known for encrypting systems and threatening to publish stolen data if a ransom is not paid. The group maintains a leak site where it lists victims and posts samples of claimed material. Such listings are assertions made by the group; independent verification of the data’s origin or sensitivity is not provided by the site itself.
The group has appeared in multiple incidents involving commercial organisations, typically using common initial-access techniques such as compromised remote-desktop services or phishing. Its public claims about any specific victim, including the current listing, should be treated as unverified until corroborated by the affected organisation or law-enforcement findings.
Magnolia (Israel) and its sector
Magnolia (Israel) operates in the jewellery trade, offering silver items and accessories. It sells through platforms such as buyme.co.il gift cards and has exhibited at the Vicenza jewelry fair in 2025 and 2026. Companies in this sector routinely process customer orders, payment details, supplier invoices and internal business records.
Jewellery retailers hold data that can include names, addresses, purchase histories and financial references. A breach at such a firm therefore touches both commercial confidentiality and personal customer information, even when the exact records taken are not yet known.
What was likely exposed
The listing refers to internal files and mentions approximately 38,000 invoices. No further breakdown of file types or data categories has been released by the company or by investigators. Organisations of this kind typically store customer contact details, order and payment records, and supplier documentation; however, whether any of these categories are present in the claimed exfiltration is unconfirmed.
Until Magnolia or a competent authority publishes a formal notification, the precise contents of the files remain unknown.
The real-world impact
Individuals named in invoices or order records could face follow-on fraud attempts if their contact or payment information is later misused. For the company, the exposure of internal commercial documents may affect supplier relationships and competitive information, regardless of whether customer data is involved.
Because the scale of any personal data remains undisclosed, the practical consequences for most customers cannot yet be quantified. Monitoring of financial accounts and vigilance over unsolicited communications are standard precautions in such cases.
Were you affected?
Check any recent correspondence from Magnolia and review bank or credit-card statements for unfamiliar activity. You can also run a free exposure scan of your email address against known breach data sets to see whether your information appears in previously published collections. If the company issues an official notice, follow its recommended steps for identity protection or credit monitoring.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Forces Listed by medusalocker Ransomware GroupDolrad Listed by medusalocker Ransomware GroupHathcock (Personal) Listed by medusalocker Ransomware GroupPenticton and District Society for Community Living Listed by medusalocker Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Magnolia (Israel) Listed by medusalocker Ransomware Group →
Publicly posted by medusalocker — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.