A vendor on a well-known leak forum claims to have breached Israel’s Population and Immigration Authority and is selling the entire national registry, 9.2 million records covering essentially the whole country. Ransomnews reviewed the sample the seller published, and the data checks out as genuine. It’s just not from 2026, or anywhere close to it.
The listing promises national ID numbers, addresses, phone numbers, birth and death dates, immigration dates, and family links for every person in the file, packaged as a 7.5 GB database.
To make it look convincing, the seller attached records supposedly belonging to the Netanyahu and Herzog families, including one person who died back in 1976 still appearing as a standard entry.
“To make the data look impressive, the seller attached a section matching records to well-known Israelis, presented as members of the Netanyahu and Herzog families, including a figure who died in 1976 and appears as a deceased record.” reads the report published by Ransomnews. “This is authenticity bait, and we have redacted it. It is worth noting for one reason: a registry that carries the long-deceased is a registry that behaves like a real civil register, and that detail matters when you try to work out how old this data is.”
That detail alone hints at how old this file actually is, a current registry wouldn’t be built around decades-dead public figures as its proof of authenticity.
Ransomnews’s technical checks back up that the data itself is real, even if the “2026” label isn’t. Israeli national ID numbers carry a mathematical check digit, so random numbers fail that test roughly nine times out of ten, and in the 100,000-record sample, all but three passed. Family-unit IDs also clustered together far more often than random chance would produce, the kind of pattern you only get when data comes out of a genuine household-structured government database.
Then comes the detail that undoes the entire “current” framing. Every date field in the sample, births, deaths, immigration dates, internal record updates, stops cold in 2005. Nobody in the file was born, died, immigrated, or had a record touched after that year, which is simply impossible for a live 2026 national registry.
“Here is the finding that undoes the headline. We checked the newest value in every date field in the sample. Birth dates stop at 2005. Aliyah dates stop at 2005. Death dates stop at 2005. The internal “record updated” field stops at 2005, and it ramps up year over year through the early 2000s and then falls off a cliff.” continues the report. “Nobody in this data was born, immigrated, died or had their record touched after 2005. A live 2026 registry would contain millions of people born in the last twenty years. There are none.”
That specific cutoff points to something with a long, ugly history. Back in 2006, an employee at Israel’s Ministry of Social Affairs copied the entire population registry and took it home, and the file eventually became a searchable tool known as “Agron 2006” that spread across file-sharing networks for years, leading to six arrests by Israel’s Justice Ministry in 2011. Same authority, same nine-million scale, same field structure, same 2005-into-2006 cutoff. It’s very hard to look at this listing and not see the same file resurfacing under a fresh coat of paint.
When Ransomnews challenged the seller directly about the outdated timestamps, he pushed back, insisting the published sample was only the oldest portion of the database and sent over what he said were the final rows to prove the rest was current. Those final rows, the actual tail end of the 9.22 million records, also stopped dead in 2005. He’d essentially handed over his own rebuttal evidence and it confirmed exactly what he was trying to disprove.
The seller, going by GordonFreeman, isn’t some throwaway account either. He’s a VIP member with a strong reputation built on dozens of threads, mostly recycled national databases from Ecuador, Venezuela, Panama, Spain, and Guatemala.
That pattern matters: a vendor whose whole catalogue is repackaged government data isn’t necessarily lying about possessing the file, he’s just misrepresenting when it was collected, and reputation built on volume tends to reward exactly that kind of relabeling.
None of this means people should shrug it off. A national ID number issued once never expires, and names, birthdates, and family relationships don’t age out of usefulness for identity theft or social engineering just because the file is twenty years old. The right response here isn’t panic about a fresh 2026 breach, since that framing is exactly what the seller wants people to believe, but old, permanent identifiers still recirculating is its own quieter, longer-lasting problem.
“Old breaches do not die, they get re-listed. The Israeli population registry is one of the most durable examples in the world, and its reappearance on a 2026 forum under a “current” label is a reminder that data with permanent identifiers has a very long tail. If you cover or respond to this, the two questions that matter are always the same: is the data real, and is it new. Here the answer is yes and no.” concludes the report. “The check digits, the household structure and the immigration demographics say the data is genuine. The hard wall at 2005 says it is not new.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)