Israel
ILRansomware victim intelligence profile · Ranked #18 globally · Updated: May 28, 2026
Ransomware Threat Profile: Israel
Israel ranks #18 globally for ransomware attacks, with 133 confirmed victims in this database — representing 0.7% of the worldwide total. The most active ransomware groups targeting Israel include Handala, Qilin, Funksec.
The most frequently targeted industries in Israel are Technology, Public Sector, Business Services. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.
Israel's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Israel should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Israel (20 cached of 133 total)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | FWMK Law Offices | Dragonforce | Business Services | May 27, 2026 |
| 2 | Belz Institutions | Qilin | — | May 13, 2026 |
| 3 | Magnolia (Israel) | Medusalocker | — | May 5, 2026 |
| 4 | guesty, LITELLM/TRIVY CAMPAIGN (TEAMPCP) | Vect | Technology | Apr 15, 2026 |
| 5 | Behind the Curtain: Full Details of Shin Bet’s Iran Desk Officers Released | Handala | — | Mar 25, 2026 |
| 6 | From Hunter to Hunted: Mossad’s Former Chief Falls into the Trap | Handala | — | Mar 25, 2026 |
| 7 | palram.com | Killsec | Manufacturing | Mar 17, 2026 |
| 8 | Mossad’s Secret Treasury Exposed: 50,000 Confidential Emails Leaked | Handala | — | Mar 17, 2026 |
| 9 | Shock for Israeli Intelligence: 100,000 Classified Emails of Mossad’s Ex-Deputy Director S... | Handala | Public Sector | Mar 16, 2026 |
| 10 | Tamir Hayman | Handala | — | Mar 13, 2026 |
| 11 | Hebrew University of Jerusalem | Handala | Education | Mar 13, 2026 |
| 12 | Raz Zimmt (head of the Iran Desk at Israeli security institutes) | Handala | — | Mar 12, 2026 |
| 13 | shlomo bit | Killsec | — | Mar 11, 2026 |
| 14 | Unprecedented Disclosure of 50 Senior Israeli Air Force Officers’ Information | Handala | Public Sector | Mar 9, 2026 |
| 15 | Israeli Weather Stations Crippled | Handala | Public Sector | Mar 8, 2026 |
| 16 | Jerusalem Water Supply Facilities | Handala | Public Sector | Mar 7, 2026 |
| 17 | ELC Security Products | Qilin | — | Mar 5, 2026 |
| 18 | Atlas Insurances Ltd | Handala | Financial Services | Mar 5, 2026 |
| 19 | Israel Institute for National Security Studies (INSS) | Handala | Public Sector | Mar 4, 2026 |
| 20 | Israel Opportunity Energy | Handala | Energy | Mar 2, 2026 |
Frequently Asked Questions
How many ransomware attacks have occurred in Israel?
Israel has recorded 133 ransomware victim disclosures in this database, ranking #18 globally. This represents 0.7% of all tracked ransomware attacks worldwide.
Which ransomware groups target Israel?
The ransomware groups most active in Israel are Handala, Qilin, Funksec, Ransomhub. These groups collectively account for the majority of victim disclosures attributed to Israel.
Which industries are most targeted by ransomware in Israel?
In Israel, the most frequently targeted sectors are Technology, Public Sector, Business Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Israel rank globally for ransomware attacks?
Israel ranks #18 globally for ransomware attacks with 133 victim disclosures, representing 0.7% of the worldwide total of 18,180 tracked victims.
How can organisations in Israel protect against ransomware?
Organisations in Israel should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Israel is also recommended.