Atraf / Cyberserve breach by Black Shadow

In late October 2021, the Iran-linked Black Shadow group — the same actor behind the 2020 Shirbit breach — attacked Israeli web-hosting company Cyberserve and, days later, leaked the entire user database of Atraf, a popular Israeli LGBTQ dating and nightlife app. Because the exposed data included users' locations and, for some, their HIV status, the breach was widely described as life-threatening for parts of Israel's LGBTQ community.

What happened

On 29 October 2021, Black Shadow announced it had compromised Cyberserve, taking down the hosting provider's servers and numerous sites it served — including Atraf, a major bus operator's site, and others. The group demanded $1 million in cryptocurrency within 48 hours to prevent publication of the stolen data.

When the ransom went unpaid, the attackers released the material in stages. On 2 November 2021, they published what they described as the full Atraf database — around one million listings — to a Telegram channel. The data included users' names, locations, and HIV-status information that members had entered into their profiles.

Impact

• Around a million Atraf records were exposed, alongside data from other Cyberserve clients. A follow-on leak included the medical records of roughly 290,000 patients from a separate hosted service.
• Calls to Israel's LGBT helpline (Aguda) doubled as users feared being outed; for closeted individuals, exposure carried serious personal-safety risks.
• The Atraf website was permanently removed from the internet in an effort to limit further harm — a rare case where a service was shut down entirely as part of incident response.

Attribution

Israeli analysts attributed the operation to Black Shadow, assessed as an Iran-linked actor, citing the same techniques, leak-and-extort playbook and victim-blaming seen in earlier attacks. The strike came just days after a cyberattack disrupted Iranian fuel-station payment systems, fuelling the assessment that it was part of the broader Iran–Israel cyber conflict rather than ordinary cybercrime.

Why it matters

The Atraf leak is a stark illustration of how breaches can cause direct human harm that no insurance payout or credit-monitoring offer can undo. Sensitive attributes like sexual orientation and HIV status are precisely the categories GDPR and similar laws designate as "special" — and this case showed why. It also marked an escalation in the Iran–Israel cyber confrontation, in which civilian, deeply personal data was deliberately weaponised to terrorise a vulnerable population.