ZIV Hospital Listed by malekteam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out healthcare providers, where the combination of sensitive personal data and operational urgency creates high-pressure targets. In late 2023 this pattern reached ZIV Hospital, a medical centre in Safed in northern Israel, when the group known as malekteam publicly listed the organisation on its leak site.

The listing, reported on 24 December 2023, asserts that internal files were taken during a ransomware attack. The number of people affected remains unknown, and independent confirmation of the claims has not been published. For patients and staff the episode underscores how medical records, once removed from controlled systems, can become a lasting source of risk.

Inside the incident

Public reporting states that ZIV Hospital was listed by the malekteam ransomware group on 24 December 2023. The group claims it successfully compromised the medical centre and exfiltrated internal files. According to the listing, the material includes information relating to more than 300 000 patients and companions. The group further asserts that the files contain names and identity numbers, contact numbers and emails, types of diseases and drugs, genetic codes of patients, their DNAs and RNAs, and other related documents.

No independent verification of the volume of data, the precise method of intrusion, or the timeline of the attack has been released. The facts available describe only an alleged ransomware incident that resulted in the exfiltration of internal files; technical details such as initial access vector, encryption status of systems, or any ransom demand remain undisclosed.

The group behind it: malekteam

malekteam is a ransomware operation that has appeared on public leak sites, typically advertising stolen data after claiming successful attacks. Like many such groups, it follows a double-extortion model: encrypting systems while simultaneously threatening to publish or sell exfiltrated material if demands are not met. The group’s listings often include dramatic language and specific data-type claims intended to pressure victims.

In this case the group claims it holds extensive patient-related information from ZIV Hospital. Those assertions appear solely on its leak-site posting and should be treated as unverified claims rather than established fact. Prior public activity by malekteam has focused on a range of sectors, with healthcare among the targets that attract attention because of the sensitivity of the data involved. No additional statements by the group about this particular victim beyond the listing itself have been recorded in the available facts.

About ZIV Hospital

ZIV Hospital, also referred to as the ZIV medical centre, is a healthcare facility located in Safed in northern Israel. Hospitals of this type provide clinical care, diagnostic services and patient administration for local and regional populations. As a matter of ordinary practice they maintain electronic and paper records that include personal identifiers, medical histories, treatment details and contact information for patients and, in many cases, accompanying family members.

A breach affecting such an organisation is consequential because the data held is both intimate and long-lived. Medical records cannot be changed like a password; once exposed they remain a permanent reference that can be misused for identity fraud, insurance abuse or targeted social engineering. The hospital’s role as a trusted repository of health information means any confirmed compromise carries implications for patient trust and regulatory obligations under applicable privacy and health-data laws.

What was likely exposed

The available facts state that internal files were exfiltrated in a ransomware attack. The malekteam listing specifically claims that the material covers more than 300 000 patients and companions and includes names and identity numbers, contact numbers and emails, types of diseases and drugs, genetic codes, DNAs and RNAs, and additional documents. These details originate solely from the group’s public claim.

Organisations of this kind typically store precisely the categories of data the group describes—demographic identifiers, clinical notes, laboratory results, medication lists and, in specialised cases, genetic information. However, the exact contents of the files allegedly taken from ZIV Hospital remain unconfirmed. No independent inventory or forensic summary has been published, so the scale and precise composition of any exposed data set cannot be stated as established fact.

What's at stake

For individuals whose information may have been involved, the primary risks are identity theft, medical fraud and targeted phishing. Identity numbers combined with medical details can be used to open fraudulent accounts or submit false insurance claims. Contact data enables more convincing social-engineering attempts that reference real diagnoses or treatments. Genetic information, if present, raises longer-term privacy concerns because it is unique and hereditary.

For the hospital the stakes include potential regulatory scrutiny, the cost of investigation and remediation, and erosion of public confidence. Even when systems are restored, the knowledge that sensitive records may circulate outside institutional control creates ongoing operational and reputational pressure. Because the number of affected people is listed as unknown, the full extent of these risks cannot yet be quantified.

If your data was in this claimed breach

Anyone who has been a patient or companion at ZIV Hospital should treat the possibility of exposure seriously. Begin by monitoring bank and credit accounts for unusual activity and place fraud alerts where available. Be cautious of unsolicited calls or messages that reference medical details; verify any such contact through official hospital channels. Consider changing passwords on email and patient-portal accounts and enabling multi-factor authentication where offered.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal risk assessment while further official information remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.