Alon Gal

In an interview published by PureVPN, Gal described monitoring the sale and subsequent public circulation of Facebook user data and raising awareness of the exposure. He warned that combining phone numbers with personal information could support targeted phishing, impersonation and cyberstalking.⁠[1]

Gal published an account of Hudson Rock’s discovery of employee Citrix credentials after the Change Healthcare ransomware incident. He considered the infostealer infection consistent with the incident’s chronology but explicitly stated that the researchers could not establish whether those specific credentials had been used.⁠[2]

He examined advertisements selling corporate access and cross-referenced identifiable organizations with infostealer records. The article showed that organizations advertised by access brokers could also have exposed employee credentials, while acknowledging that such overlap did not establish which credentials enabled a particular intrusion.⁠[3]

Gal and EclecticIQ researcher Arda Büyükkaya co-authored an investigation into spear-phishing against Pakistan Telecommunication Company. They linked stolen email credentials, malicious messages and wmRAT activity, assessing Bitter APT as the likely actor. The attribution was the research team’s assessment.⁠[4]

SecurityWeek reported that Gal examined leaked CrunchbaseCrunchbaseCrunchbase is a private-company data and intelligence platform headquartered in San Francisco. It launched in 2007 as TechCrunch’s startup database, and its own company profile lists Michael Arrington as founder. It passed to AOL with TechCrunch in 2010 and was spun out of AOL/Verizon in 2015 with backing from Emergence Capital, with Jager McConnell as CEO; it has since raised more than $100 million and launched Pro, Enterprise, API and Crunchbase News products. Since 2025 it has focused on using AI to forecast private companies’ funding, growth and exits, delivering its data through MCP, APIs and third-party AI platforms.Open the full entry material and identified personal information, signed contracts and other corporate documents. His LinkedInLinkedInLinkedIn is a social networking platform for professionals. It was founded in 2002 by Reid Hoffman and others, launched in 2003, and listed on the New York Stock Exchange in 2011; after Microsoft acquired it for approximately $26.2 billion in 2016, it became a wholly owned Microsoft subsidiary. Its revenue comes from membership subscriptions, advertising, and recruitment solutions.Open the full entry post limited his analysis to the Crunchbase material. Crunchbase separately confirmed document theft from its corporate network to SecurityWeek, saying the incident was contained and operations were unaffected.⁠[5][6]

Gal presented research conducted by Hudson Rock and Matt Kirkland into an Artlist subdomain serving fake verification prompts and malware. The investigation connected site credentials with an earlier infostealer infection. The article stated that Artlist had not responded to the researchers by publication.⁠[7]

He introduced three Cavalier threat feeds: C2 Data, ClickFix and PhaaS, covering command-and-control infrastructure, deceptive verification pages and phishing-service networks. His product announcement described APIs for security teams and the combination of infrastructure observations with credential-exposure records.⁠[8]

Gal discussed the FortiBleed 2.0 investigation on LinkedIn. The accompanying report compared two collections of FortiGate-related material, distinguishing files, account records, host identifiers and domain labels. It emphasized that a second investigation did not establish a second wave of compromise, and recorded credential labels did not verify present-day access.⁠[9][10]

Gal has said that he became interested in cybercrime at 14, worked in intelligence during his Israel Defense Forces service and subsequently continued as a consultant before co-founding Hudson Rock. The company identifies him as co-founder and CTO, notes his Unit 8200 background and lists fellow co-founder Roi Carthy as CEO.⁠[1][11]

The OSINT Experts Society lists Gal in its Leadership Circle. His public LinkedIn profile identifies his location as Israel’s Tel Aviv District: https://www.linkedin.com/in/alon-gal-utb (opens in a new window) . He publishes as Alon Gal — Under the Breach at https://underthebreach.medium.com/ (opens in a new window) and previously shared research through the Twitter account UnderTheBreach.⁠[12][9][3][1]