A Palestinian youth wearing masks used by computer hackers who attacked a number of Israeli websites recently, seen backdropped by the Temple Mount in Jerusalem’s Old City, April 8, 2013. Photo: Sliman Khader/Flash90.

CTech – In the past year, 30 percent of serious cybersecurity events in Israel were not reported to the proper authorities as required by law, according to data released Thursday by Israel’s Privacy Protection Authority.

New regulations requiring companies and non-profits to report on significant breaches came into force in May 2018. Since then, the authority has handled 146 severe cybersecurity events, only 103 of which were reported by the organizations that fell victim to the attacks, according to the data. The rest of the incidents were reported by third parties. The authority estimates that an unknown number of additional attacks took place but were not reported.

The sector that suffered the most attacks was insurance and finance (23 percent), followed by data management and healthcare (10 percent each), communications and education (8 percent each), and internet (7 percent).

Cases in which hackers used an inherent security flaw in the organization’s database accounted for 15 percent of the attacks. Theft of passwords and usernames were conducted in 7 percent of cases, human errors and malware were spotted on 9 percent of cases, and unintentional loss of media or unauthorized delivery of data was the case in 8 percent of attacks.

A spokesperson for the Privacy Protection Authority told Calcalist that the authority can fine offenders who fail to report attacks or fail in other ways to conform with the regulations meant to protect personal data. The authority is also authorized to cancel or temporarily suspend an organization’s license to hold a database and to make any infringement public.