Hackers Reveal Thousands of Email Addresses and Passwords of Israeli State Employees

CTech – Around 5,000 email addresses with the suffix of gov.il belonging to Israeli state employees, as well as their passwords, have been discovered as part of an analysis of a massive 100GB leak uploaded to a hackers forum. The stockpile, known as COMB21 (standing for Compilation of Many Breaches and the year of its discovery) includes 3.2 billion passwords and 2.18 billion addresses.

The leak was analyzed by Brazilian network security company Syhunt and according to its report, the stockpile of emails and passwords is “being actively shared among hackers and cybercriminals in the form of a single, 7zip compressed archive.”

Based on the Syhunt report, 4,984 passwords from domains using gov.il were affected. This is a small fraction compared to the US with 625,505 .gov passwords exposed, but nevertheless not insignificant.

The report added that “despite the efforts over the recent years by the companies and organizations to monitor password leaks, harden the security of web applications, login mechanisms, switch to HTTPS and respond to password leaks, the publication and active sharing of this password leak compilation is a major blow to Internet security.”

It concluded that “while some of the above listed domains, organizations, agencies and companies may have publicly acknowledged about breaches over the years and adopted appropriate response and countermeasure actions, a significant number of leaked passwords appear to originate from breaches that affected other companies and websites that simply allowed to create accounts linked to user emails. This means services like LinkedIn among other social networks, and multiple other Internet websites not referenced in the COMB archive.”

The Israel National Cyber Directorate told Calcalist that “this is a collection of addresses and passwords that were leaked throughout many years from a variety of sources and private services, mostly old stockpiles of work addresses used by employees. We remind everyone that the workplace email shouldn’t be used for private use and that different passwords should be used for connecting to the organization than for other services.”