Israeli Education Ministry Breached Privacy Laws, Leaked Data of Thousands of Special Needs Students

Israel's Ministry of Education has been found to have violated privacy laws and caused a massive leak of confidential information belonging to thousands of minors, according to an administrative review by the Privacy Protection Authority of the Ministry of Justice. The investigation revealed that detailed personal data of 21,439 students in the special education system from the ultra-Orthodox sector was exposed.

The leaked data included full names, ID numbers, birth dates, home addresses, school names, religious affiliation, and comprehensive medical reports with specific diagnoses and disability information. Inspectors identified severe security failures, including uncontrolled server access, transmission of sensitive data over unsecured channels without encryption, and a complete absence of cybersecurity risk assessments. The ministry also lacked established information security regulations and a certified database passport.

Despite the ministry's claim of holding an international ISO/IEC 27001 certificate, the regulator stated that international compliance does not exempt a government body from adhering to Israeli law. The ministry was found to be in violation of Article 17 of the Privacy Protection Law, which assigns responsibility for archive security to the data owner, along with eight other related regulations.

The incident occurred in May 2024 when ministry employees created an open online form to streamline student placement. An Excel spreadsheet containing all personal records was uploaded to this form, which was accessible without authorization or passwords. The link was distributed to employees of religious schools via both official and personal email, leading to the document circulating among unauthorized individuals.

The leak became public following a journalistic investigation. For families in the religious sector, the exposure of such sensitive information has led to significant social repercussions. Parents reported that details about children with autism or Down syndrome quickly spread through synagogues and communities, potentially jeopardizing future marriage prospects for relatives. A group of parents has filed a lawsuit against the ministry in the Lod District Court, highlighting their predicament: while obligated to provide medical records for state assistance, the system failed to ensure basic data security.

The final report from the state regulator did not include decisions on personal fines or criminal charges against the officials responsible for the breach.