lavi.co.il listed on Inc Ransom leak site

• Ransomware group: Inc Ransom
• Country: Israel
• Sector: Technology
• Announcement date: February 18, 2025

Inc Ransom claims data breach at lavi.co.il

The ransomware group known as Inc Ransom has listed the organization lavi.co.il on its dedicated leak site. According to the group's announcement, which was posted on February 18, 2025, the threat actors claim to have successfully exfiltrated a significant amount of data belonging to the entity. The group asserts that the breach occurred around December 30, 2024, although this timeline remains an unverified claim by the attackers.

Ransomware groups often utilize leak sites as a tool for psychological warfare. By publishing the names of their victims, these groups aim to create public pressure and reputational damage to coerce the target into paying a ransom. This practice is a hallmark of modern cyber extortion, where the threat is not just the encryption of local systems, but the public exposure of sensitive corporate or personal information.

Details of the alleged theft

The Inc Ransom group has provided specific metrics regarding the volume of information they claim to have acquired from the organization's systems. While the group has not provided specific details regarding the content of the allegedly leaked data, they have shared the following technical specifications regarding the dataset:

• Total data size: approximately 93.2 GB
• Total file count: 119,128 files

The announcement includes operational details and contact information belonging to the organization. This inclusion of specific organizational details is a common tactic used by threat actors to increase the visibility of the attack and exert maximum pressure on the victim to meet their demands.

About the targeted organization

The victim, lavi.co.il, is identified as Kibbutz Lavi Hotel. This is a hospitality business located in northern Israel that offers various hotel and accommodation services. The facility operates as a hotel with a specific focus on religious and cultural tourism, serving travelers interested in the cultural heritage of the region.

Analysis and potential implications

Given the double-extortion tactics frequently employed by the Inc Ransom group, the potential publication of the claimed data could lead to significant operational and reputational damage for the organization. In such scenarios, attackers do not merely lock files but threaten to release stolen information to the public or to competitors to force a payment. This dual-threat approach significantly increases the pressure on the victimized entity.

Because the organization is based in Israel, legal obligations under relevant data protection regulations may arise following a confirmed breach. If the stolen dataset contains employee or customer information, such data could be utilized by malicious actors for secondary attacks or identity theft. The group's past activities suggest that the leak of such data may trigger targeted phishing attacks, where attackers use the stolen information to craft highly convincing fraudulent communications to deceive employees or clients.

Furthermore, this situation could pose risks to the organization's supply chain partners. In the interconnected landscape of modern business, a breach in one organization can serve as a gateway or a source of intelligence for attacking other entities within the same ecosystem. Organizations in the hospitality and technology sectors can mitigate these risks by implementing robust data protection frameworks, maintaining strict access controls, and ensuring that all employees are trained to recognize sophisticated phishing attempts. Regular monitoring of data egress and maintaining comprehensive backups are also standard defensive measures to protect against the impact of such incidents.