The Egyptian Tax Authority (ETA) Listed by Moneymessage Ransomware Group

On November 17, 2024, the Egyptian Tax Authority (ETA) appeared on the leak site operated by the moneymessage ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the government body responsible for tax collection across Egypt. The disclosure does not specify the number of records affected or list exact data types beyond claiming that sensitive internal documents were taken.

Details in the Leak-Site Listing

The moneymessage leak site, accessible via the onion address indexed by ransomware.live, publicly named the ETA and asserted that data had been stolen. It presents the Egyptian Tax Authority as a victim that has not yet met the group’s demands. The posting does not quantify the volume of material taken, nor does it describe the specific systems breached or the precise categories of information inside the alleged archive. Public views of the listing show only the organization name, the ransomware brand, and a statement that exfiltrated files are available for review by interested parties. No sample documents have been openly released at the time of this analysis, and the disclosure gives no deadline beyond the standard pressure tactics typical of this actor.

Why This Matters for You and Your Family

When a national tax authority loses control of internal files, the exposure can reach far beyond government offices. Tax records frequently contain full names, national identification numbers, addresses, income details, bank account information, and employer data for millions of citizens and businesses. If those details surface, identity thieves can file fraudulent returns, open accounts in your name, or combine them with other leaks to build convincing profiles. Even if your specific file is not among those published, the precedent matters: once tax agencies are successfully hit, copycat attackers target similar organizations, increasing the odds that your information will appear in a future breach. For ordinary families this translates into higher risk of tax fraud, loan scams, and persistent harassment that can last years.

The Doxxing and Identity-Chain Risks

Tax-agency data is especially dangerous because it links government identifiers to real-world addresses, phone numbers, and financial histories. Attackers routinely cross-reference such material with credential leaks, social-media handles, and gaming accounts. A single exposed national ID can anchor an identity chain that reveals family relationships, children’s names, and even school records. Credential leaks like this one often cascade into account takeovers on email, banking, and entertainment platforms. Children’s gaming accounts are particularly vulnerable because parents frequently reuse passwords or security questions derived from official documents. The result is a widening web of doxxing that can expose home addresses, family photos, and live locations. Continuous monitoring across large breach repositories is one of the few practical ways to detect these linkages before they are exploited.

Moneymessage Group Track Record

Public reporting attributes the moneymessage ransomware operation to a group that emerged in early 2024. The actor is known for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating documents for later public release. Notable prior targets have included mid-sized corporations and public-sector entities across multiple countries. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates data quietly, then deploys ransomware and posts evidence on its leak site when negotiations stall. Its playbook emphasizes steady pressure through partial data dumps and direct threats rather than immediate mass publication. While the exact size of its victim list remains fluid, security researchers tracking ransomware.live note that moneymessage maintains a consistent cadence of new listings each month.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, national ID, and online handles so you can see exactly what chains back to the ETA breach.
• Rotate any password you have ever used on Egyptian government portals or related services, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often reuse details from official tax records.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents appearing on data-broker or extortion sites.

The Egyptian Tax Authority breach is a reminder that government systems holding ordinary citizens’ most sensitive identifiers remain attractive targets. Acting quickly on credential hygiene and identity mapping can limit how far this incident reaches into your life. Start your DoxxScan trial and let its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation specialists, and household coverage—including children’s gaming accounts—work for your family before the next wave of extortion sites adds fresh material.