Loading story…
A seller on a leak forum advertised 9.2 million Israeli population records as a newly stolen 2026 registry allegedly taken from the Population and Immigration Authority, but reporting found the dataset is authentic historical data, not evidence of a fresh compromise. Analysis of sample records reportedly confirmed valid Israeli ID check digits and realistic household structures, while showing that key date fields stop in 2005, undermining the seller’s claim that the database is current.
The records are assessed as a resurfaced copy of the long-known "Agron 2006" leak, which originated after a Ministry of Social Affairs employee copied the registry in 2006. The seller, using the handle GordonFreeman, reportedly tried to support the claim by sharing tail rows from the database, but those entries also ended in 2005. Although the incident does not appear to reflect a new breach, the exposed permanent identifiers, including national ID numbers, birthdates, and family relationship data, still create ongoing identity theft and social-engineering risk.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Israel’s Justice Ministry made six arrests in 2011 in connection with the Agron 2006 population registry case. This tied law enforcement action to the earlier theft and spread of the database.
In 2006, an employee at Israel’s Ministry of Social Affairs copied the entire population registry and took it home. The copied data later became known as the "Agron 2006" database.
Based on the authority, scale, field structure, and consistent 2005 cutoff, investigators assessed the advertised dataset was likely a resurfaced copy of the long-known Agron 2006 leak rather than a new breach. The finding reframed the incident as recirculation of old stolen data.
After being challenged, the seller claimed the published sample only reflected the oldest portion of the database and shared purported final rows to support that assertion. Those tail-end records also ended in 2005, undermining the claim that the rest of the database was current.
Ransomnews reviewed the sample and found the records appeared genuine, with ID numbers largely passing check-digit validation and family-unit patterns matching a real household-structured database. However, all key date fields, including birth, death, immigration, and update fields, stopped in 2005, showing the dataset was not a current 2026 registry.
A seller using the handle GordonFreeman advertised a 7.5 GB database of about 9.2 million records, claiming it was Israel’s 2026 national population registry obtained by breaching the Population and Immigration Authority. The listing said the data included national ID numbers, addresses, phone numbers, birth and death dates, immigration dates, and family links.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026
A threat actor has advertised an alleged **Revolut** customer database for sale on a cybercrime forum, claiming it contains more than **75 million records** tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic. Revolut said it has found **no evidence of unauthorized access** or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around **May 2025**, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Jul 30, 2026