Shirbit insurance breach by Black Shadow

In late November 2020, a previously little-known group calling itself Black Shadow breached the Israeli insurer Shirbit, then staged a days-long public extortion campaign that became one of Israel's most closely watched cyber incidents — and an early example of an attack carrying strong signals of state-aligned, ideologically motivated intent rather than pure profit.

What happened

On 30 November 2020, Black Shadow announced via social media that it had compromised Shirbit and obtained the insurer's client database. The group began publishing samples of stolen material — scanned ID cards, passports, marriage certificates, financial documents, email PST files and audio recordings — to prove the breach and pressure the company.

The attackers demanded an initial ransom of 50 bitcoin (roughly $950,000 at the time), warning that the figure would double, then double again, with each missed deadline. Negotiation messages were later leaked, with the hackers at one point telling Shirbit to "be a mensch" and pay.

Impact

• Highly sensitive personal documents belonging to Shirbit customers were published in stages and offered for sale on a Telegram channel, exposing victims to identity theft and fraud.
• Shirbit, which notably held insurance contracts for some government employees, faced intense scrutiny over whether sensitive populations had been exposed.
• The company refused to pay, stating it would not negotiate with criminals — a decision that drew both praise and criticism as more data was dumped.

Attribution

Black Shadow's behaviour — public leaks, victim-blaming, escalating threats and an apparent willingness to cause harm beyond simple monetisation — led Israeli analysts to assess the group as likely Iran-linked, rather than a conventional financially-motivated ransomware crew. The same group resurfaced in 2021 with the high-profile Cyberserve/Atraf attack, reinforcing that assessment.

Why it matters

The Shirbit breach was a wake-up call for Israel's financial and insurance sector and for the country's regulators. It demonstrated how an attacker could weaponise deeply personal documents — not just card numbers — to inflict reputational and psychological damage, and it foreshadowed a wave of Iran–Israel cyber confrontations in which civilian data became a battlefield. Israel's Capital Market and Privacy Protection authorities used the case to push insurers toward stronger data-security obligations.