A 9.2 million-record Israeli registry is on sale as new. Every date stops in 2005.
A leak-forum vendor is advertising Israel’s full population registry as a current breach. The sample is genuine — and two decades old, tracing back to a 2006 insider theft.
The listing offers what it calls the complete database of Israel’s Population and Immigration Authority: 9.2 million records in a 7.5 GB package, promising national ID numbers, addresses, phone numbers, birth and death dates, immigration dates and family links. Ransomnews obtained and examined the published sample and found the records authentic. It also found that every date field in them terminates in 2005 — birth dates, aliyah dates, death dates, and the internal “record updated” field alike. The distribution ramps through the early 2000s and then stops. “Nobody in this data was born, immigrated, died or had their record touched after 2005,” the analysis concluded; Security Affairs is carrying that finding, and the underlying verification is Ransomnews’s rather than its own. No named analyst is attached to it.
The 2005 cutoff points at a known incident. In 2006 an employee of Israel’s Ministry of Social Affairs copied the population registry and removed it; the file became a searchable tool circulated on file-sharing networks under the name “Agron 2006” and produced six arrests. The pattern of resale is also known. In September 2021, Security Affairs covered an actor using the handle “Sangkancil” advertising 7 million Israeli records with attached ID cards, driver’s licences and tax bills, timed to Rosh Hashanah; Israel’s National Cyber Directorate investigated and assessed initially that the documents were old data. Neither the Population and Immigration Authority nor the Directorate has said anything on the record about the current listing. The page carrying the Ransomnews analysis is roughly a week old — this is not a weekend event.
Assessment: The value here is not the breach, because there isn’t one. It is that a genuine file makes durable resale inventory: authenticity survives obsolescence, and a buyer checking a handful of records will find them real. Two prior data points do not make a trend, and we decline to draw one. What they do establish is the response pattern — official silence, or a low-key assessment that the data is old, arriving after the claim has already travelled. Watch for the file to reappear with the date fields stripped, which is the cheap fix that would make this genuinely difficult to date. Absence of an Israeli statement is not confirmation of anything.