Menora Mivtachim Fined NIS 256,000 for Serious Security Breach
Translated & summarized from Ice by baba
Israel's Privacy Protection Authority fined Menora Mivtachim NIS 256,000 for a serious security breach that exposed personal data of 138 policyholders. The company delayed reporting the incident, which occurred on November 12, 2025, until November 27, 2025, violating immediate reporting regulations. The PPA stressed that reporting is required upon learning of a breach, not after internal investigations are complete, to enable swift oversight and minimize privacy risks.
The story in 5 lines · by baba
- Menora Mivtachim was fined NIS 256,000 by Israel's Privacy Protection Authority for a security breach.
- Personal data of 138 policyholders was exposed to an unauthorized insurance agent.
- The company delayed reporting the November 12, 2025 incident until November 27, 2025.
- The Privacy Protection Authority stated immediate reporting is mandatory upon learning of a breach.
- The breach involved sensitive financial, salary, and medical information from a secure database.
Israel's Privacy Protection Authority (PPA) has fined insurance company Menora Mivtachim NIS 256,000 for failing to immediately report a serious security incident. The penalty was imposed after an administrative inquiry found that personal information of 138 policyholders was exposed to an unauthorized insurance agent. The company reported the breach to the PPA only after completing its internal investigations.
According to the PPA's findings, an insurance agent mistakenly gained access to a report containing sensitive personal data of policyholders assigned to another agent. This information was extracted from Menora Mivtachim's customer database, which is classified as highly secure and holds data on approximately 2 million individuals, including financial, salary, and medical details.
The incident highlighted the company's reporting obligations to the PPA. Menora Mivtachim became aware of the breach on November 12, 2025, but did not report it until November 27, 2025, more than two weeks later. The PPA ruled that delaying the report until internal investigations were complete violated the immediate reporting requirement stipulated in the privacy protection regulations.
Menora Mivtachim argued that the reporting obligation only arises after internal investigations and the identification of the technological failure are finalized. However, the PPA rejected this, stating that immediate reporting is required upon learning of a serious security event, regardless of the completion of internal probes. The authority emphasized that the purpose of immediate reporting is to enable swift regulatory oversight and minimize potential harm to public privacy.
The PPA also dismissed the company's claim that the exposed data was transferred to an isolated subsystem with limited information, thus requiring only basic security measures. The authority clarified that the method of data transfer or presentation does not alter the security level derived from the source database. The initial fine was NIS 640,000, but it was reduced by 60% to NIS 256,000 due to factors including the company's lack of prior violations, its proactive reporting that stopped the breach, and the appointment of a legal privacy officer.
Mentioned
