Read the period, unit and primary source together
The table is a five-row compilation of official public statements, not an event database collected by CyberFixCrew. The 2024 announcement was published on 11 March 2025. The 2025 figures are visible in post 307 in the directorate’s official channel view. Measurement year and publication or review date are different fields.
During this review, the official indexed text of the 2024 government announcement was readable, while the direct page returned no readable body. The accessible channel view contains the 2025 statement; its standalone embedded view was not readable through the same access route. These access limits are part of the source record rather than grounds for filling gaps from unrelated reports.
| Period | Metric in the source | Reported value | Source statement |
|---|---|---|---|
| 2024 | Cyber incident reports | Approximately 17,000 | 2024 annual-report announcement |
| 2024 | Phishing share in the reporting breakdown | 41% | 2024 annual-report announcement |
| 2025 | Cyber incident reports received by center 119 | Approximately 26,500 | 2025 announcement, official channel post 307 |
| 2025 | Phishing share in the reporting breakdown | 52% | 2025 announcement, official channel post 307 |
| 2025 | Year-over-year growth in reports, as stated | 55% | 2025 announcement, official channel post 307 |
Keep reports distinct from successful attacks or unique victims
A report is not automatically one successful attack, one affected organization or a financial loss. Reporting behavior, detection, classification and collection processes can affect totals. This compilation does not deduplicate individual records or determine how many businesses experienced a confirmed compromise.
The phishing percentages describe the published reporting breakdown. They are not the percentage of Israeli businesses that suffered phishing, the chance of a particular business being breached or a global phishing rate. Preserve the denominator and period when discussing them.
The source totals are approximate. The stated 55% increase is retained as a figure published by the directorate, not recalculated from the two rounded totals. The table does not establish that every category definition and reporting process was identical in both years. Do not turn a change in share into a causal explanation or a precise business-risk forecast.
Understand the CSV and its verification record
The downloadable CSV contains the five rows, measurement period, metric, numeric value, unit and an approximation flag. It also records the publisher, source title, source URL, publication date as previously verified, source locator, checked date and a verification note. Those fields help a reader trace a claim rather than treating a number as self-explanatory.
The preserved file records a check on 29 October 2026. This English page was reviewed on 30 October 2026; that does not silently rewrite the CSV’s earlier snapshot. In particular, the saved 2025 publication date was not independently re-extracted from HTML during this review. The current source view supports the figures used here, while the file retains its recorded provenance.
Use the source and limitations alongside any copied row. The CSV is an attributed secondary compilation, not the underlying national incident records, a representative survey of small businesses or permission to infer unreported events. A missing field should remain a documented gap rather than be completed with a guess.
Use a narrow, attributed statement when citing the figures
A defensible citation names the directorate, year, unit and relevant qualifier. For a report count, retain “approximately” where used. For a percentage, state that it belongs to the reporting breakdown. Link the primary statement and, where useful, the compilation and its review notes.
For a chart or comparison, keep approximate totals and reported percentages visibly distinct. Do not use a title such as “all attacks” for a reports series. If adding another country or source, first establish whether its unit, collection process and period are comparable.
Translate national context into business questions, not a fear score
Our practical interpretation is to examine how the business handles messages, verifies sensitive requests, protects administrator access and recovers necessary activity. Those are questions to investigate in the actual environment, not findings established about a reader’s website by national figures.
For example, a payment-detail request, an administrator login and restoration of an order system have different evidence and control requirements. Email-domain authentication, account authentication and recovery checks address different parts of that picture. Choose the next review from the business dependency and known gap rather than assigning a priority solely from a national percentage.
CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. Our Israeli website and digital-infrastructure knowledge provides the professional context for this interpretation. The reporting figures remain attributed to the national source; they are not customer results, measurements of our service or evidence of comparative company performance.
Extend the series only when the source and definitions support it
This page covers the stated 2024 and 2025 periods. It does not present complete-year 2026 figures or claim to describe every current threat. A later update should identify a relevant official source, distinguish publication from measurement dates and review whether the metric still means the same thing.
When a source changes, review the visible table, explanatory text and downloadable record together. Keep a clear account of what was corrected or added. A new headline should not silently replace an older metric with a different unit or mix alerts, reports and confirmed incidents into one series.
Readers can use the methodology page to understand our evidence approach and the related guides for practical business decisions. If you need a technical review, describe your actual systems and concern. The national reporting context can inform the conversation; it cannot diagnose your website or establish which controls have already been verified.