Meitav Trade Suffers Cyberattack, Customer Data Exposed

Meitav Trade, a subsidiary of the investment house Meitav, reported a significant data security incident that exposed personal information of its clients. The breach, discovered on Saturday, September 23, 2023, led to the exposure of full names, identity card numbers, and bank account details. The incident came to light after approximately 3,000 unsolicited SMS messages containing one-time authentication codes were sent to customers.

Meitav and its parent company reported the "data security incident" to the stock exchange, but the exact method of the breach remains undisclosed. The exposure occurred through an external supplier's API interface, which was reportedly compromised. An external party exploited a function within this interface to extract personal data from the accounts of customers who received the fraudulent messages. While several attempts to alter the destination phone number for authentication codes failed, the data extraction was successful.

Meitav Trade immediately blocked access to the compromised interface. The company stated that client funds and trading systems were not accessed, and no passwords, financial data, or identification documents were exposed. Meitav Investment House clarified that the exposure was limited to the supplier's interface and did not affect other group systems or clients. The company has committed to notifying all affected individuals whose information was compromised.

Following the reports, Meitav Trade's stock experienced a decline of over 5% at the opening of trading on the Tel Aviv Stock Exchange. The company has engaged two external professional entities to conduct thorough investigations. Meitav estimates that the incident is concluded and will not significantly impact ongoing operations, though it cautioned that this assessment could change.