A 9.2 million-record ‘Israeli breach' turns out to be genuine data that is twenty years old

A vendor on a leak forum claimed to have breached Israel’s Population and Immigration Authority and offered the national registry for sale: 9.2 million records advertised as containing national ID numbers, addresses, phone numbers, birth and death dates, immigration dates and family links, packaged as a 7.5 gigabyte database. Ransomnews reviewed the published sample and found the data genuine but roughly 20 years old, not from 2026 — a finding reported by Security Affairs in early August. The verification method is transferable and worth stating plainly: Israeli national ID numbers carry a mathematical check digit, so fabricated or randomly generated numbers fail validation roughly nine times out of ten. In a 100,000-record sample, all but three passed. Family-unit identifiers also clustered far more tightly than random generation would produce. The data is authentic; the claim of a new breach is not.

The same discipline applies to the influence-operations numbers now in circulation. Axios reported on August 27 that Meta removed a network of four Facebook accounts and 31 Instagram accounts linked to individuals operating from Iran, using AI to target US audiences with posts on American politics aimed at politicians and journalists. Traffic was routed exclusively through proxy and hosting services in the US and Canada to obscure its origin. Meta assessed the reach as “moderate,” with a spokesperson telling Axios it generated “meaningful but limited” engagement against a baseline in which state-backed campaigns typically show low reach. Thirty-five accounts is a small object to carry the rhetorical weight now attached to it. An earlier Meta action, reported by The Record on March 11, was an order of magnitude larger — nearly 300 accounts posing as journalists and commentators, roughly 41,000 followers, minimal engagement — and Meta said then it had not yet observed significant new influence campaigns tied to the escalation.

Assessment: The registry case is the cleanest illustration this desk has of a specific market failure: leak-forum sellers are not lying about the data, they are lying about the date. Authenticity checks pass, recency checks are never run, and the story ships. Expect this pattern to recur, because ageing genuine data is abundant and free while fresh access is expensive. On the Meta side, note that the takedown counts are the only hard numbers anyone has about Iranian influence operations, and they are published by the company doing the removing — a defender’s self-report, with no independent audit of what was missed. Small numbers, generously interpreted, become large claims.