Meitav Investment House Stock Plummets After Data Breach Affecting 3,000 Clients

The stock of Meitav Investment House experienced a significant drop on Tuesday following the company's disclosure of a data security incident. The breach, which occurred on Saturday, September 26th, involved a vulnerability in an interface managed by an external supplier, leading to the exposure of personal information for approximately 3,000 clients.

According to the company's report, the incident allowed unauthorized access to client data including full names, identity card numbers, bank account numbers, and beneficiary details. Meitav emphasized that the breach did not grant access to client funds or trading systems. The company was alerted to the issue when clients reported receiving unsolicited one-time password (OTP) verification codes via SMS.

Meitav launched an immediate investigation in collaboration with the external supplier. Their findings indicated that an API interface, operated by the supplier, was compromised. The company acted swiftly to block access to this interface, halting further unauthorized activity. Subsequent in-depth security audits by both Meitav and the supplier confirmed that around 3,000 SMS messages containing OTP codes were sent to clients. While there were isolated attempts to alter the phone number for OTP delivery, these were unsuccessful.

The investigation also revealed that an external party exploited a function to retrieve personal data from affected accounts. Meitav stated it will notify all clients whose personal information was compromised. The company asserts that the security event has concluded, has not impacted ongoing operations, and is not expected to have a material financial impact or cause significant damage.