Meitav Trade Exposes Customer Data Through Third-Party API Flaw

Meitav Trade, Israel's largest trading platform, reported on Tuesday that a cyberattack resulted in the exposure of personal customer information. The breach occurred when an external party exploited a vulnerability in an API interface managed by a third-party vendor.

The incident came to light on Saturday, September 26, after customers reported receiving unsolicited one-time verification codes via SMS. An investigation by Meitav Trade and its vendor revealed a security gap in one of the vendor's interfaces. Meitav Trade has since blocked access to the compromised interface and ceased its use.

According to the company, approximately 3,000 SMS messages were sent to customers as a result of the incident. While several attempts were made to alter the phone number for verification codes, these were unsuccessful. The investigation confirmed that personal details, including full names, ID numbers, bank account numbers, and beneficiary information, were accessed. However, Meitav Trade stated that customer funds and accounts remain secure, and trading systems, passwords, financial data, and identification documents were not compromised.

The company plans to notify affected customers whose personal information was accessed. This breach follows a series of technical issues experienced by Meitav Trade customers, including a display error in early September that showed zero balances, which was attributed to a data update. In March 2025, trading systems for Meitav Trade and IBI were temporarily unavailable due to a communication system failure with technology provider FMR.

The incidents gain significance given Meitav Trade's rapid growth. As of the end of June 2026, the platform served 130,000 customer accounts, adding nearly 19,000 in the first half of the year. Customer assets under management reached approximately NIS 46 billion by the end of June 2026, up from NIS 41 billion at the end of 2025 and NIS 32.9 billion at the end of 2024.