In the past year, 30 percent of serious cybersecurity events in Israel were not reported to the proper authorities as required by law, according to data released Thursday by Israel’s Privacy Protection Authority.
New regulations requiring companies and nonprofits to report significant breaches came into force in May 2018. Since then, the authority has handled 146 severe cybersecurity events, only 103 of which were reported by the organizations that fell victim to the attacks, according to the data. The rest of the incidents were reported by third parties. The authority estimates that an unknown number of additional attacks took place but were not reported.
The sector that suffered the most attacks was insurance and finance (23 percent), followed by data management and healthcare (10 percent each), communications and education (eight percent each), and internet (seven percent).
Cases in which hackers used an inherent security flaw in the organization’s database accounted for 15 percent of the attacks. Theft of passwords and usernames were conducted in seven percent of cases, human errors and malware were spotted in nine percent of cases, and unintentional loss of media or unauthorized delivery of data was the case in eight percent of attacks.
A spokesperson for the Privacy Protection Authority told Calcalist that the authority can fine offenders who fail to report attacks or fail in other ways to conform with the regulations meant to protect personal data. The authority is also authorized to cancel or temporarily suspend an organization’s license to hold a database and to make any infringement public.
Raphael Kahan / CTech
{Matzav.com}
