Sensitive Medical Data of 21,000 Haredi Special Education Students Leaked

The breach originated in May 2024 when ministry employees created a digital form to streamline student placements. To facilitate this, they exported a data file from a ministry system containing names, ID numbers, addresses, religious affiliation, and specific medical diagnoses, such as autism and Down syndrome. The file and form were left completely unprotected by passwords and were accessible via an open link sent to educational personnel, including to private email addresses. By March 2025, the data had been widely disseminated online to unauthorized parties.

The Privacy Protection Authority cited severe security failures, including deficiencies in permissions management, encryption, and a lack of required security documentation or risk assessments. The authority rejected the ministry's defense that its international ISO certification exempted it from Israeli privacy regulations. Because the leak occurred before a recent legal amendment allowing financial penalties, no fine was issued. However, affected parents have filed a civil lawsuit against the Ministry of Education in the Lod District Court, citing fears of social stigma and the impact on marriage prospects within the Haredi community.