Ransomware victim disclosure
← All victimsMagnolia (Israel)
Claimed by Bavacai · listed 15 days ago
Status timeline
- Listed
May 5, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileMagnolia is an Israeli jewelry company specializing in silver and accessories. It participates in the Vicenza international jewelry fair (2025/2026) and sells products via the buyme.co.il gift card and experiences platform in Israel. The company issues invoices under SI/IN/OV prefixes in Hebrew.
- Industry
- Jewelry & Silver Accessories Retail
Attack summary
Severity: medium — Data has been published (disclosed_status: data_published) and includes business/financial documents (~38k files, invoices), but there is no confirmed large-scale PII, medical, or regulated data exposure stated; scale and sensitivity remain moderate.The Bavacai ransomware group claims to have exfiltrated approximately 38,000 files from Magnolia, including invoices in Hebrew, and has published the data.
Data the group says was taken
AI dossier — extracted from the leak post- Invoices (Hebrew, SI/IN/OV prefix)
- Internal business files (~38,000 files)
What the group claims
Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sells via buyme.co.il gift cards. ~38k files, invoices in Hebrew (SI/IN/OV prefix).
The leak post
captured from the group's siteFile Manager File Manager home page BARAAAI Data is being prepared for publication. BAPAMAI Data is being prepared for publication. BAUARAI Data is being prepared for publication. BAVADAI Data is being prepared for publication. BAVACAI Data is being prepared for publication. BAVAQAI Data is being prepared for publication. Raycolighting DEMO 3137 S Alameda Street, Los Angeles, CA 90058, USA $10 000 Organization with 2 emails extracted. Domain: raycolighting.com baralai Data is being prepared for publication. CEAGESP / Netfeirasp DEMO São Paulo, Brazil $20 000 Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts. Colegio María Inmaculada (CMI) DEMO Moravia, San José, Costa Rica $50000 Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2. Académie de Montpellier / CSJM DEMO Béziers, Occitanie, France $15000 French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credentials. Palmers Relocations DEMO Victoria, Australia $63 000 Australian …
Sources
Source
Indexed 15 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
