Hudson Rock Limited is an Israeli cybersecurity company headquartered in Tel Aviv specialized in infostealer malware.[1][2] Hudson Rock was co-founded in 2020 by Alon Gal, who previously worked in Unit 8200 of the Israeli Defense Forces and Roi Carthy, a technology industry businessman.[3] Hudson Rock has identified data breaches involving personal information from companies including Facebook,[4] Twitter,[5] Airbus,[6] Telefónica,[1][7] Samsung Electronics,[8] Jaguar Land Rover and Telefónica.[3][9][10] In 2024, Hudson removed a report about Snowflake after legal pressure.[11]
Alon Gal
Alon Gal (b. 1996) is an Israeli cybersecurity expert and entrepreneur. He is the co-founder and chief technology officer of Hudson Rock,[12]
One of Gal's contributions to the industry was to uncover a massive data breach that affected over 533 million Facebook users.[13] The breach included users' phone numbers, email addresses, birthdays, and other personal information. Gal was the first to report the breach, which ultimately led to a $276 million fine for Facebook from the Irish Data Protection Commissioner for violating General Data Protection Regulation laws.[14]
In addition to the Facebook breach, Gal also played a role in uncovering a 2023 data breach that affected over 200 million Twitter users. The breach involved user information, including email addresses, usernames, and other personal information.[15]
Gal's work has also led to the uncovering of other significant data breaches, including a T-Mobile breach that exposed the personal information of 40 million customers.[16]
For a period of time between 2019 and 2021, Gal operated a pseudo-anonymous Twitter account and a Medium (website) blog called Under The Breach, the account gained popularity for the uncovering of several additional data breaches such as the 91 million Indonesian Tokopedia users data leak,[17] the 337,000 Maltese voters database leak which resulted in a 65,000 euro fine,[18] and the 20 million BigBasket users data leak.[19]
External links
- Under The Breach
- Alon Gal's interview at PureVPN.
References
- Infostealer Infections Lead to Telefonica Internal Ticketing System Breach SecurityWeek, 2024-10-08, retrieved 2025-04-27^
- Twitter hacked, email addresses of over 200 million users exposed: Report WION, retrieved 2023-05-13^
- Ionut Ilascu. HellCat hackers go on a worldwide Jira hacking spree BleepingComputer, 2025-04-05, retrieved 2025-04-27^
- Facebook data leak: Half a billion users' information posted on hacking website, cyber experts say CNN Business, 2021-04-04, retrieved 2025-04-27^
- Twitter users' data hacked: Email address, phone numbers The Guardian, 2023-01-05, retrieved 2025-04-27^
- Brian Krebs. FBI Hacker Dropped Stolen Airbus Data on 9/11 Krebs on Security, 2023-09-14, retrieved 2025-04-27^
- Telefonica Breach Exposes Jira Tickets, Customer Data Dark Reading, 2024-10-08, retrieved 2025-04-27^
- Dirk Knop. Data leak: 270,000 Samsung customer tickets on the darknet Heise.de, 2025-04-01, retrieved 2025-12-04^
- HellCat Ransomware Hits 4 Firms using Infostealer-Stolen Jira Credentials Hackread, 2025-04-05, retrieved 2025-04-27^
- Jaikumar Vijayan. Ransomware Group Claims Attacks on Ascom, Jaguar Land Rover SecurityWeek, 2023-10-13, retrieved 2025-04-27^
- Hudson Rock yanks report into alleged Snowflake compromise retrieved 2025-12-03^
- Twitter in data-protection probe after '400 million' user details up for sale BBC News, 2022-12-29, retrieved 2023-05-19^
- Aaron Holmes. 533 million Facebook users' phone numbers and personal data have been leaked online Business Insider, retrieved 2023-04-28^
- Emma Roth. Meta fined $276 million over Facebook data leak involving more than 533 million users The Verge, 2022-11-28, retrieved 2023-04-28^
- Joseph Menn. Hackers leak email addresses tied to 235 million Twitter accounts The Washington Post, retrieved 28 April 2023^
- Rachel Lerman. T-Mobile hack is a return to the roots of cybercrime The Washington Post, 19 August 2021, retrieved 28 April 2023^
- Indonesia's Tokopedia probes alleged data leak of 91 million users Reuters, 2020-05-02, retrieved 2023-04-28^
- IT firm C-Planet fined €65,000 over massive voter data breach Times of Malta, retrieved 2023-04-28^
- Big Basket data breach: email IDs, phone numbers, home addresses of two crore Indians allegedly leaked on the web Business Insider, retrieved 2023-04-28^