Key Takeaways
- The Israel student data breach exposed sensitive personal and medical data belonging to approximately 21,000 special education students.
- An unsecured online file allowed unauthorized people to access and download children’s records.
- Israel’s privacy regulator found multiple security violations but announced no specific fine or further enforcement action.
Israel’s Education Ministry violated privacy laws after sensitive medical, religious and personal information about approximately 21,000 special education students became accessible to unauthorized people through an unsecured online file, the Justice Ministry’s Privacy Protection Authority said Thursday.
The exposed records concerned students in the ministry’s ultra-Orthodox education district and included names, identification details, home addresses, school information and medical data identifying disabilities. The regulator classified the disclosure as a serious security incident following an administrative review.
Unsecured Files Exposed Thousands of Children’s Records
The authority opened its investigation in March 2025 after reports revealed that the information had circulated online. Investigators traced the file’s creation to around May 2024, when ministry employees sought to simplify the placement process for special education students in the ultra-Orthodox, or haredi, education sector.
Employees extracted sensitive information from a ministry system and connected it to a digital form designed for educational institutions to submit student information. The file was intended to operate in the background, supplying data to the form.
However, the form and the underlying file were configured so that anyone with the link could access them. The file lacked password protection and could be viewed or downloaded, while recipients could forward the link to others.
The link was distributed in May 2024 to staff members at haredi educational institutions through official and private email accounts. The authority found that the information eventually reached members of the public and other unauthorized individuals.
When the incident was first reported in March 2025, Israeli broadcaster N12 reported that the file contained records on 21,439 children, including names, identification numbers, birth dates, addresses and medical information.
Regulator Finds Broader Failures in Data Security
The Education Ministry attributed the disclosure to what it described as a likely isolated error in the access-permission settings of one form. According to the ministry, the error allowed an outside user to locate the underlying file through a link.
The authority identified additional shortcomings in the Israel student data breach beyond the alleged configuration error. It found that an employee who was not on the current list of authorized personnel had extracted the information. The ministry also lacked a required database description, a compliant information-security policy, and an up-to-date security risk assessment.
The regulator cited failures in access management, system operations and data transmission. Sending sensitive information through an open link without accepted encryption measures violated rules governing the transfer of information over the internet, it said.
The database contains sensitive information about more than 100,000 people, placing it under high security requirements, according to the authority.
The ministry argued that its certification under international information-security standards exempted it from some regulatory requirements. The authority rejected that position, stating that international certification does not independently replace compliance with Israeli privacy law.
Privacy Violations Raise Concerns for Families
The authority concluded that the ministry violated Section 17 of Israel’s Protection of Privacy Law, which assigns database owners responsibility for protecting the information they hold. It also found violations of several provisions of the country’s data-security regulations.
Parents said the exposure could reveal private medical diagnoses within their communities and potentially affect their children and families, including their social relationships and matchmaking prospects in haredi communities.
The regulator’s announcement did not specify a fine or confirm whether additional enforcement action would follow.
Because the Israel student data breach occurred before Amendment 13 to Israel’s Protection of Privacy Law took effect, the authority conducted its review under the legislation and enforcement powers applicable at the time.
The findings underscore the risks of handling sensitive student records through digital systems without adequate access controls and security safeguards.
Visit more of our news! Future Education Magazine