// CONFIRMED RANSOMWARE ATTACKS · COUNTRY
Ransomnews has confirmed 32 ransomware attacks in Israel between March 2019 and September 2025, each one verified against a public source such as a breach notification, regulatory filing, court record or press report. That is 0.3% of the 9,520 confirmed incidents in the dataset. So far in 2026, 0 have been confirmed, against 1 in 2025 and 3 in 2024. The most affected sector is healthcare, with 6 confirmed victims (19%). Netanya is the city with the most confirmed victims, at 4. Where the operator is attributed, Pay2Key leads with 5 confirmed victims. A ransom payment is on the public record in 2 cases and a refusal in 8; the outcome is unrecorded in the remaining 22.
Confirmed ransomware attacks in Israel by year
The current year is a partial count. Confirmation lags the attack itself, so recent months keep filling in after the fact; read a low figure for the latest year as incomplete rather than as a decline.
| Year | Confirmed attacks | Ransom paid (public) | Ransom refused (public) |
|---|---|---|---|
| 2019 | 1 | 0 | 0 |
| 2020 | 8 | 2 | 1 |
| 2021 | 11 | 0 | 3 |
| 2022 | 1 | 0 | 0 |
| 2023 | 7 | 0 | 1 |
| 2024 | 3 | 0 | 2 |
| 2025 | 1 | 0 | 1 |
Which ransomware groups attack organisations in Israel most
The operator is attributed in 24 of the 32 confirmed incidents. Counts are confirmed victims, not leak-site claims, so they run well below the totals the groups publish about themselves. Group names link to the live Ransomtracker profile where one exists.
Most active groups by confirmed victims
Where the confirmed attacks in Israel fall
Most affected sectors
Cities with the most confirmed victims
Ransom payment outcomes in Israel
Among the 10 confirmed incidents in Israel where the outcome is on the public record, 2 paid and 8 refused, a disclosed payment rate of 20%. The remaining 22 carry no public statement either way. Victims that pay have every incentive to stay quiet and public bodies are the most likely to announce a refusal, so treat this as the disclosed rate, not the true one. The ransomware payment rate analysis explains how the disclosed rate has moved since 2018 and how it compares with incident-response firm samples.
Most recent confirmed ransomware attacks in Israel
The 25 most recently confirmed of 32 incidents, newest first. Every row links to the public source it was verified against.
| Date | Organisation | Sector | Location | Records | Group | Ransom paid | Source |
|---|---|---|---|---|---|---|---|
| September 2025 | Shamir Medical Center | Healthcare | Be'er Ya'akov, Israel | — | Qilin | No | ynetnews.com |
| September 2024 | Pearl Cohen | Legal | Tel-Aviv, Israel | — | BianLian | No | calcalistech.com |
| July 2024 | Globes | Other | Rishon LeZion, Israel | — | Medusa | Unknown | israelhayom.co.il |
| January 2024 | Modi'in Ilit | Government | Modi'in Ilit, Israel | — | — | No | pc.co.il |
| November 2023 | Bezeq | Utilities | Tel Aviv-Yafo, Israel | — | SiegedSec | Unknown | ynet.co.il |
| November 2023 | Israel Government Archive | Government | Jerusalem, Israel | — | Toufan | Unknown | catalog.archives.gov.il |
| November 2023 | Ziv Medical Center | Healthcare | Safed, Israel | — | Malek | Unknown | gov.il |
| October 2023 | Ono Academic College | Education | Kriat Ono, Israel | — | Malek | Unknown | ifi.today |
| September 2023 | Eitanim-Kfar Shaul Mental Health Center | Healthcare | Jerusalem, Israel | — | — | Unknown | bnn.network |
| August 2023 | Mayanei Hayeshua Medical Center | Healthcare | Bnei Brak, Israel | — | Ragnar Locker | No | timesofisrael.com |
| February 2023 | Israel Institute of Technology (Technion) | Education | Hafia, Israel | — | DarkBit | Unknown | i24news.tv |
| July 2022 | Sapir College | Education | Ashkelon, Israel | — | — | Unknown | israelnationalnews.com |
| November 2021 | Atraf | Service | Tel Aviv, Israel | — | Black Shadow | No | jpost.com |
| October 2021 | Hillel Yaffe Medical Center | Healthcare | Hadera, Israel | — | — | No | govinfosecurity.com |
| October 2021 | E.M.I.T. Aviation Consulting Ltd. | Manufacturing | Tzur Yigal, Israel | — | LockBit | Unknown | cyberintelmag.com |
| September 2021 | Voicenter | Utilities | Ramat Gan, Israel | — | Deus | Unknown | haaretz.com |
| August 2021 | Bar Ilan University | Education | Ramat Gan, Israel | — | Darkrypt | No | haaretz.com |
| July 2021 | Pionet | Technology | Haifa, Israel | — | — | Unknown | databreaches.net |
| May 2021 | Eitan Medical | Healthcare | Netanya, Israel | — | N3tw0rm | Unknown | telecomnews.co.il |
| May 2021 | Ecolog Engineering Ltd | Construction | Rehovot, Israel | — | N3tw0rm | Unknown | acronis.com |
| April 2021 | Veritas Logistics | Transportation | Lod, Israel | — | N3TW0RM | Unknown | timesofisrael.com |
| April 2021 | H&M Israel | Retail | Tel Aviv, Israel | — | N3TW0RM | Unknown | bleepingcomputer.com |
| February 2021 | Ness Digital Engineering (SwiftNess) | Service | Tel-Aviv, Israel | — | Ragnar Locker | Unknown | jpost.com |
| December 2020 | Portnox | Technology | Ra'anana, Israel | — | Pay2Key | Unknown | timesofisrael.com |
| December 2020 | Israel Aerospace Industries | Manufacturing | Lod, Israel | — | Pay2Key | Unknown | jpost.com |
Frequently asked questions
How many ransomware attacks in Israel have been confirmed?
Ransomnews has confirmed 32 ransomware attacks in Israel since March 2019, including 0 so far in 2026. Each one is verified against a public source such as a breach notification, regulatory filing or press report. The true total is higher, because many victims never disclose; confirmed counts are a floor, not a ceiling.
Which ransomware group is most active in Israel?
Pay2Key, with 5 confirmed victims, followed by N3tw0rm (4) and Black Shadow (2). These are confirmed victims, not leak-site claims, counted among the 24 incidents where the operator is attributed.
Which sector is hit most by ransomware in Israel?
Healthcare, with 6 confirmed incidents (19% of the total). Technology follows with 6, then Education with 4.
Which cities in Israel have the most confirmed ransomware attacks?
Netanya (4), Tel-Aviv (3), Jerusalem (2), Lod (2), Ramat Gan (2). City is recorded where the victim organisation is headquartered or the incident was reported, so distributed organisations are counted once.
How often do ransomware victims in Israel pay the ransom?
Among the 10 confirmed incidents in Israel with a public outcome, 2 paid and 8 refused, a disclosed payment rate of 20%. Most victims never state whether they paid, and those who pay have the least reason to say so, so the disclosed rate understates real payment behaviour. The payment rate analysis tracks this figure since 2018.
How to read this page. Every incident counted here was verified by Ransomnews against at least one public source. Leak-site listings alone do not qualify, because operators inflate, duplicate and occasionally fabricate claims, so these totals are a defensible floor rather than a full census. Records exposed and ransom outcomes appear only where a named source disclosed them. The page is regenerated from the live database, which refreshes weekly. Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, ransomnews.com, with a link to this page. Bulk access and methodology questions: [email protected]. See also the monthly ransomware statistics and the Ransomtracker.