A well-known data-leak vendor is offering what they describe as the current registry of Israel’s Population and Immigration Authority: 9,220,583 records covering the entire population, with national ID numbers, addresses, phone numbers and family links. Ransomnews analysed the 100,000-record sample the seller published. The data is real Israeli registry data. It is not current. Every date field in it stops in 2005.
A note on what we are publishing. This article does not link the sample, does not reproduce any individual’s record, and does not carry the seller’s download link or contact ID. Our analysis is statistical: counts, validation rates and distributions across the 100,000-row sample, never individual data. We are reporting on a dataset that consists of private citizens’ personal information, and the point of the piece is to establish what it actually is, not to spread it further.
Update, 10 August 2026: we contacted the seller, who insisted the data is current and said the public sample was only the oldest records. He then sent the database’s last rows to prove it. They stop at 2005 as well. Details at the end of the analysis.
What the seller is claiming
The post is titled “ISRAEL (2026) Population and Immigration Authority 9.22M Data” and opens with a flat claim: “I have breached the database of the Population and Immigration Authority of Israel current 2026 obtaining 9220583 data of the entire general population.” The seller lists 30 fields, among them tz (the teudat zehut, Israel’s national ID number), full name and former name, street and house number, city and postal code, phone, birth date and death date, country of birth, aliyah date, and the ID numbers of each person’s father, mother, spouse and family unit. The package is described as 7.5 GB in .DB format, with contact through a Session messenger address that we are not republishing.
To make the data look impressive, the seller attached a section matching records to well-known Israelis, presented as members of the Netanyahu and Herzog families, including a figure who died in 1976 and appears as a deceased record. This is authenticity bait, and we have redacted it. It is worth noting for one reason: a registry that carries the long-deceased is a registry that behaves like a real civil register, and that detail matters when you try to work out how old this data is.
The sample is genuine Israeli registry data
The seller published a 100,000-record sample. That is about 1.1 percent of the 9.22 million being advertised, and it is enough to test whether the data is what it claims to be. It holds up. The header matches the 30 fields in the listing exactly, and the contents pass the checks that fabricated data usually fails.
The strongest signal is the national ID. Israel’s teudat zehut carries a check digit, so a random nine-digit number is valid only about one time in ten. In this sample, all but three of the 100,000 ID numbers pass that check, and there is not a single duplicate across the file. Numbers do not behave like that unless they came from a real registry.
| Claim or property | What the sample shows | Our reading |
|---|---|---|
| Genuine national ID numbers | 99,997 of 100,000 pass Israel’s check-digit test, zero duplicates | Strongly supported |
| Real family and household links | 43 percent of family-unit IDs resolve to another person inside a 1 percent slice, while spouse and parent links resolve at the 1 percent base rate | Household-clustered, consistent with a real register |
| Immigration Authority data | 141 countries of birth: Israel 60 percent, former USSR 8.9, Romania 3.4, Poland 3.4, Morocco 2.8; 39 percent carry an aliyah date | Matches Israeli immigration demographics |
| A civil register that retains the deceased | 13.5 percent carry a death date; births run from the 1800s onward | Behaves like a real population register |
| “Current 2026” data | The newest birth, aliyah, death and record-update date is 2005. Zero records dated after 2005 | Contradicted |
| 9,220,583 total records | Sample is ~1.1 percent of that; full size cannot be checked from it | Unverifiable from the sample |
One number in that table is worth dwelling on. The family-unit ID links resolve internally at 43 percent inside a slice that is only about 1 percent of the claimed dataset. If families were scattered at random you would expect roughly 1 percent, which is exactly what the spouse and parent links do. The family field resolving forty times higher means the export was pulled out household by household, keeping relatives together. That is how a real registry is structured, and it is very hard to fake by accident.
Why we think this is the Agron registry, not a 2026 breach
Here is the finding that undoes the headline. We checked the newest value in every date field in the sample. Birth dates stop at 2005. Aliyah dates stop at 2005. Death dates stop at 2005. The internal “record updated” field stops at 2005, and it ramps up year over year through the early 2000s and then falls off a cliff. Nobody in this data was born, immigrated, died or had their record touched after 2005. A live 2026 registry would contain millions of people born in the last twenty years. There are none.
That points somewhere specific. In 2006 an employee at Israel’s Ministry of Social Affairs copied the entire population registry and took it home. It passed through a chain of hands and ended up as a searchable tool called “Agron 2006” that let anyone query any citizen, and it spread across file-sharing networks for years. Israel’s Justice Ministry arrested six people over it in 2011. As The Register reported at the time, the file held around nine million people, living and dead, with names, ID numbers, addresses, birth dates and family relationships. That is the same authority, the same scale, the same field set, and the same 2005-into-2006 cutoff we see here.
We cannot prove byte-for-byte that this is the Agron file rather than some other pre-2006 extract. But the evidence all points one way: authentic registry data, frozen in 2005, from a body whose registry is already known to have walked out the door in exactly this form. The most likely explanation by a wide margin is that this is the long-circulating Agron dataset, dressed up as a fresh 2026 breach.
We asked the seller, and the answer confirmed it
After this article first published, we put the 2005 ceiling to GordonFreeman directly. He pushed back: “No bro, it’s current. The data I uploaded to the post are the first entries of the database, which contains 9.22M. I’ll show you the last entries of the DB in a moment.” His argument was that we had only looked at the oldest records, and that the tail of the database was up to date.
He then sent a second sample: the last rows of the database, IDs 9,220,354 through 9,220,585, which is the very end of the 9.22 million he is advertising. We ran the same date checks on it. Every one of those records also stops in 2005. The newest birth date is 2005, the newest record update is 2005, and not a single row carries a date after that. The proof the seller offered that the data is current is itself made of 2005 data.
The way he packaged it tells the same story. In his own file listing the database is named 9M-ciudadanos-ISRAEL, Spanish like the rest of his catalogue and sitting next to a registro-electoral file, and both are stamped 21 April 2026. That is a packaging date, not a collection date. A twenty-year-old registry zipped into a new file this year gets this year’s timestamp, and that fresh date on stale data is exactly the kind of thing that gets misread, or sold, as current.
That closes the only real gap a skeptic could point to. We have now checked both ends of the set, the first rows in the public sample and the last rows the seller sent to rebut us, and both are frozen in the same year. The ID range also confirms the file genuinely runs to about 9.22 million rows. This is a complete, authentic copy of the Israeli population registry. It is simply twenty years old, and no amount of “current 2026” labelling in the sales thread changes the dates inside it.
Who is GordonFreeman?
Unlike the throwaway accounts that post most leaks, this one has a track record. GordonFreeman is a VIP member who joined the forum in January 2026, has run through roughly a hundred posts and more than fifty threads, and carries a positive reputation score in the high eighties with no negatives. The catalogue is almost entirely government and national data: an Ecuadorian electoral registry, Venezuelan telecom and state-oil records, a Panamanian financial unit, a Spanish foreign-ministry set, a Guatemalan finance-ministry dump. A vendor like this is a repackager. Reputation comes from volume, and volume comes from recycling datasets that are already out there, giving them a fresh title and a current year.
None of that means the vendor is lying about having the data. They almost certainly do have it. It means the framing around the data, “current 2026”, “I have breached”, should be read as sales copy, not as a description of what happened. The reputation is real. The breach story is not supported by the file.
Does twenty-year-old data still matter?
Yes, and this is the part that keeps an old leak dangerous. A teudat zehut is issued once and never changes, so a valid ID number from 2005 is still a valid ID number today. Names, parents’ names, dates and places of birth, and the family links between people do not age out either. Those are exactly the static identifiers used to pass identity checks, open the door to social engineering, and seed convincing fraud and phishing against people who have no idea their details are in circulation. For anyone in the file who is still alive, the 2005 vintage barely blunts the risk.
What changes is the correct response. This is not a fresh compromise of a live government system, and treating it as one, a new breach of 9.2 million Israelis in 2026, would be wrong and would hand the seller the exact publicity they are selling for. The accurate story is smaller and more useful: a two-decade-old national registry that never stopped circulating is being marketed again, to a new audience, under a new year.
What to take from this
Old breaches do not die, they get re-listed. The Israeli population registry is one of the most durable examples in the world, and its reappearance on a 2026 forum under a “current” label is a reminder that data with permanent identifiers has a very long tail. If you cover or respond to this, the two questions that matter are always the same: is the data real, and is it new. Here the answer is yes and no. The check digits, the household structure and the immigration demographics say the data is genuine. The hard wall at 2005 says it is not new.
We approached this the way we approach every listing on Ransomtracker: assume the seller is exaggerating, then check what they handed over. They exaggerated the one thing that would have made it a major story, the date. Israel’s Population and Immigration Authority has not commented, and we will update this article if that changes. We are not publishing the sample, the download link or the contact details. Press contact for this piece is via the Ransomnews editorial team.
Frequently asked questions
Is the Israeli population registry data real?
The sample is genuine Israeli registry data. Almost every national ID number passes Israel’s official check-digit test, there are no duplicates, and the family links and country-of-birth mix behave like a real civil register. Authenticity is not the issue here.
Is this a new 2026 breach of Israel’s Population and Immigration Authority?
The evidence says no. Every date in the sample, births, deaths, immigration and record updates, stops in 2005. A live 2026 registry would contain millions of people born after that. This looks like an aged snapshot, not a fresh breach. When we challenged the seller, he sent the database’s last rows to prove it was current, and those also stopped at 2005.
What is the Agron registry?
In 2006 a Ministry of Social Affairs employee copied Israel’s entire population registry. It spread as a searchable tool called Agron 2006 and circulated for years, leading to six arrests in 2011. It held around nine million people with the same fields seen here, which is why this 2026 listing most likely is that data.
How many records are in the leak?
The seller claims 9,220,583 records, roughly the scale of Israel’s population registry. Only a 100,000-record sample is public, about 1.1 percent, so the full figure cannot be confirmed from what we reviewed.
What data does it contain?
National ID numbers, names and former names, addresses, phone numbers, birth and death dates, country of birth and aliyah date, and the ID numbers linking each person to their parents, spouse and family unit. It contains no passwords or financial data.
Does old data like this still pose a risk?
Yes. An Israeli national ID number never changes, and names, birthplaces and family links do not either. Those static identifiers are exactly what enable identity fraud and social engineering, so a 2005 registry is still useful to attackers for anyone still living.
Who is selling it?
A reputation-carrying forum vendor using the handle GordonFreeman, whose catalogue is mostly recycled national and government databases from several countries. The account is established, which is different from the data being new.
Sources and further reading
- Ransomnews Research Team analysis of the seller’s 100,000-record sample, 10 August 2026 (aggregate statistics only)
- The Register: Israeli gov nabs 6 for leaking population register (the Agron case)
- Population and Immigration Authority (background)
- BleepingComputer: earlier Israeli registry breach claims under investigation
- StealerCheck: look up whether an address appears in stealer logs
- Ransomtracker: live leak-site and listing tracker