Cyber incident reporting in Israel: who else you may have to tell

Adv. Arthur Kartun · 19 October 2026 · Data security and incidents

After a cyber incident, the Privacy Protection Authority is often not the only party an Israeli business must tell. Depending on the business, reports may also be owed to the Israel National Cyber Directorate, a sector regulator, investors, the insurer and customers, and abroad to EU authorities or the US Securities and Exchange Commission. Most of these duties apply only to particular sectors, to listed companies, to IT and hosting providers, or through a contract, and each has its own clock. Reporting to the Privacy Protection Authority, and under the GDPR, is explained in The two clocks of breach notification. This article maps the other recipients.

The Israel National Cyber Directorate

No law requires private businesses in general to report a cyber attack to the Israel National Cyber Directorate. Any organisation may report to its national CERT, on the 119 hotline or online (Hebrew), and ask for help. There are three exceptions.

The first is IT and hosting providers. The Dealing with Severe Cyber Attacks in the Digital Services and Storage Services Sector (Temporary Provision) Law, 2023 covers businesses that provide storage or digital services, such as software development and support, IT operations or data processing, through a connection to their customers' computers, and businesses that maintain or manage such services. Since an amendment in August 2025 (Hebrew, PDF), section 2A requires such a provider to report a cyber attack actually under way against it if there is a real concern that it extends beyond the provider, or if it may significantly harm the availability, continuity or reliability of its service. The provider files one immediate report, or an initial report within 24 hours, an update within 72 hours and a summary 30 days after the update, through the national CERT. The temporary law is in force until 31 January 2027.

The second is critical infrastructure. Bodies listed in the Fifth Schedule to the Regulation of Security in Public Bodies Law, 1998, such as the Israel Electric Corporation and Mekorot, receive binding professional instructions from the Israel National Cyber Directorate, and section 10 of that law allows these to cover reporting. The instructions are not published.

The third is not yet law. The government's National Cyber Protection Bill, 2026 (Hebrew, PDF) would impose a similar reporting duty on “essential organisations” in listed sectors. It passed a first reading on 8 June 2026 and has not been enacted.

Sector regulators and investors

Banks report to the Supervisor of Banks at the Bank of Israel under Proper Conduct of Banking Business Directive 366, updated on 17 June 2026 (Hebrew, PDF): by telephone within two hours of identifying a reportable event, and in writing within eight hours of the call. Directive 361 on cyber defence management was revoked on 18 May 2026, when Directive 364 came into force.

Institutional bodies, such as insurers and pension funds, report to the Capital Market, Insurance and Savings Authority under its circular 2022-9-15 (Hebrew, PDF): by telephone and email within two hours of noticing a material event, and in writing within 12 hours of that first report. Certain licensed financial service providers, such as credit providers, report a material cyber event to the Capital Market, Insurance and Savings Authority as soon as possible (circular 2022-10-9).

A reporting company, such as one listed on the Tel Aviv Stock Exchange, must tell the market. Regulation 36 of the Securities Regulations (Periodic and Immediate Reports), 1970 requires an immediate report on an event outside the company's ordinary business that has or may have a material effect on it, and regulation 30 sets a short deadline that depends on when the company learned of the event: generally no later than the next trading day, by 9:30 or by 13:00. The staff of the Israel Securities Authority has said (Hebrew, PDF) that the materiality of a cyber attack is assessed by quantitative and qualitative measures, including damage that may still follow (legal position 105-33, updated in January 2023).

The insurer, customers and the police

Section 22 of the Insurance Contract Law, 1981 requires an insured to notify the insurer immediately after learning of the insured event. Under section 24, if late notice prevented the insurer from reducing its liability, the insurer pays only what it would have owed with timely notice, unless the delay was justified or did not hinder its investigation. The policy may add its own notice procedure, so read it before an incident.

A vendor with access to a customer's database must tell the customer. Regulation 15(a)(2)(h) of the data security regulations requires their contract to include the vendor's duty to notify the database owner of a security incident. Under regulation 11(a), that means any event raising a concern of unauthorised use of the data or harm to its integrity, not only a serious one. The regulations set no deadline, so the contract governs. And under section 3(b) of the temporary law, a provider told by an authorised official that an attack against it is a severe cyber attack must update, without delay, every connected customer that may be directly and materially harmed.

The data security regulations require notice to data subjects only if the Privacy Protection Authority orders it, after consulting the head of the Israel National Cyber Directorate (regulation 11(d)(2)). A complaint to the Israel Police is voluntary: under section 58 of the Criminal Procedure Law, anyone may file one, and the Israel Police accepts complaints online.

Reporting abroad

An EU entity of an Israeli group, in a sector covered by NIS2 (Directive (EU) 2022/2555) and generally medium-sized or larger, is subject to the law implementing NIS2 in its member state. Cloud, data centre, managed service, managed security service and certain other digital providers that offer services in the EU are covered even without an EU establishment, and must appoint a representative there (article 26). Under article 23, a significant incident requires an early warning to the national CSIRT or competent authority within 24 hours of becoming aware of it, a notification within 72 hours and a final report within one month after the notification.

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to EU financial entities. It reaches an Israeli technology supplier through the contract: article 30 requires it to include the supplier's duty to assist in an ICT incident related to its service and, for services supporting critical or important functions, the supplier's notice periods and reporting obligations towards the financial entity.

A US domestic registrant files Form 8-K under Item 1.05 within four business days of determining that a cybersecurity incident is material. Many Israeli companies listed in the US are foreign private issuers: they furnish a material incident on Form 6-K when they disclose it, or must disclose it, elsewhere, for example in an immediate report in Israel, and describe their cybersecurity risk management annually in Item 16K of Form 20-F (SEC fact sheet).

The list for the incident plan

The table sums up the recipients, their deadlines and the source of each duty:

Build the list before an incident. Mark the rows that apply to you, and for each record the contact, the reporting channel, the deadline and who decides on the report and sends it. Add each customer's contractual notice period and the insurer's hotline and policy number, and review the plan before the temporary law expires on 31 January 2027. If you hold a licence from another regulator, check it for a reporting duty too. Most of these clocks start when you learn of the incident and run together, so record that moment exactly.

Security Incidents