Malekteam claims data breach against gav.co.il

• Ransomware group: Malekteam
• Country: Israel
• Sector: Technology
• Announcement date: December 24, 2023

Malekteam claims access to gav.co.il systems

The threat group known as Malekteam has issued an announcement on a leak site claiming to have successfully breached the network systems of the Israeli technology firm gav.co.il. According to the group's claims, the intrusion resulted in the exfiltration of various types of sensitive information and the potential destruction of a significant volume of data. This announcement was made on December 24, 2023, with the group alleging that the attack occurred on the same date.

In the claim, Malekteam asserts that they gained unauthorized access to the internal network environments of the organization. The group alleges that they were able to copy a wide range of sensitive files from the institution's systems. Beyond the theft of data, the group has also made the serious claim that approximately 10 terabytes of data were either deleted or destroyed during the course of the incident.

Details of the alleged data exfiltration

The information allegedly stolen by Malekteam is diverse, spanning administrative, financial, and technical documentation. While the specific volume of files and the exact ransom demand have not been disclosed by the group, the nature of the data they claim to have acquired suggests a significant impact on the organization's privacy and operational security. The group alleges that the stolen data includes the following categories:

• Identity information
• Identification documents
• Financial files
• Administrative documents
• Project details

The claim that such a vast amount of data was deleted or destroyed highlights the destructive nature of the alleged attack, which moves beyond simple data theft into the realm of data destruction.

About gav.co.il

GAV is an Israel-based technology and software development company. The organization operates primarily in the fields of enterprise solutions, software projects, and digital services. As a firm involved in software development and digital services, the integrity of its data and the continuity of its services are central to its business model.

Analysis and implications of the claim

This claim by Malekteam poses significant risks to the operational continuity and data privacy of gav.co.il. The alleged exfiltration of identity and financial data could lead to serious consequences, such as identity theft or the execution of targeted phishing attacks against the organization's employees and customers. Because the institution is based in Israel, a confirmed breach of this nature may trigger legal processes under local data protection regulations.

The claim regarding the deletion of data underscores the critical importance of robust backup systems and comprehensive business continuity plans. In modern cyberattacks, particularly those involving ransomware, organizations often face double extortion tactics. In these scenarios, attackers not only encrypt or delete data to disrupt operations but also steal sensitive information to use as leverage for extortion. This dual threat forces organizations to defend against both availability and confidentiality risks simultaneously.

Public information regarding the Malekteam group remains limited, meaning the specific methods and motivations used by the group remain uncertain. For organizations operating in the technology and software development sector, maintaining strict access controls, implementing multi-factor authentication, and ensuring that backups are isolated from the primary network are essential defensive steps to mitigate the impact of such potential breaches.