Meitav Trade Customer Data Exposed Via Third-Party API Flaw

Meitav Trade, Israel's largest trading platform, reported on Monday that a security breach exposed personal customer information, including ID numbers and bank account details. The breach occurred when an external party exploited a vulnerability in an API interface provided by a third-party vendor.

The incident came to light on Saturday, September 26, after customers reported receiving unsolicited one-time verification codes via SMS. An investigation by Meitav Trade and its vendor revealed a vulnerability in one of the vendor's interfaces. Meitav Trade has since blocked access to the compromised interface and ceased its use.

According to the company, 3,000 SMS messages were sent to customers as a result of the incident. Attempts to change the SMS verification code destination number were unsuccessful. The investigation also found that the external party was able to extract personal details such as full name, ID number, bank account number, and beneficiary details, where applicable.

Meitav Trade stated that customer funds and trading systems were not accessed, and no passwords, financial information, or identification documents were compromised. The company will notify affected customers whose personal information was accessed. This incident follows several recent technical issues experienced by Meitav Trade customers, including a display error in early September that showed account balances as zero, and a system outage in March 2025 that prevented trading operations.

The breaches are particularly significant given Meitav Trade's rapid growth. As of the end of June 2026, the platform had 130,000 customer accounts, with nearly 19,000 added in the first half of the year. Customer assets under management reached approximately 46 billion shekels.