Menora Mivtachim Fined NIS 256,000 for Delayed Security Breach Report
Translated & summarized from Globes by baba
Israel's Privacy Protection Authority fined Menora Mivtachim Insurance NIS 256,000 for a delayed report on a security breach that exposed policyholder data. The company reported the incident over two weeks late, after internal investigations. The authority emphasized that immediate reporting is mandatory, regardless of ongoing internal reviews. The fine was reduced from an initial NIS 640,000 due to mitigating factors.
The story in 5 lines · by baba
- Menora Mivtachim Insurance fined NIS 256,000 for delayed security breach reporting.
- Personal data of 138 policyholders was exposed to an unauthorized insurance agent.
- The breach was discovered November 12, 2025, but reported over two weeks later.
- Privacy Authority: Immediate reporting is required, not contingent on internal probes.
- Initial fine of NIS 640,000 was reduced by 60% due to mitigating circumstances.
Israel's Privacy Protection Authority has fined Menora Mivtachim Insurance Ltd. NIS 256,000 for failing to immediately report a serious security incident. This marks the second time the authority has imposed financial sanctions since an amendment to the Privacy Protection Law took effect.
The authority determined that Menora Mivtachim violated the immediate reporting requirement by delaying for over two weeks a report about an incident where personal information of policyholders was exposed to an unauthorized insurance agent. The authority stressed that internal investigations or identifying the cause of the breach should not delay reporting.
The incident involved an insurance agent mistakenly gaining access to a report containing personal details of 138 policyholders belonging to another agent. This data was extracted from the company's customer database, which holds sensitive information on approximately 2 million individuals, including financial, salary, and medical data. The breach, discovered on November 12, 2025, was only reported to the authority on November 27, 2025, after the company completed its internal review.
Menora Mivtachim argued that the reporting obligation only arises after internal checks and verification of the technological failure are completed. However, the authority rejected this, stating that the immediate reporting is crucial for supervisory and control functions and that initial reports can be partial, with further details provided later.
The initial fine was NIS 640,000, but it was reduced by 60% due to factors including no prior violations in five years, the company's proactive reporting to stop the breach, and the appointment of a legal privacy officer. The authority also referenced previous fines, including NIS 256,000 to Maccabi Health Services and a violation by the Ministry of Education involving sensitive data of 21,000 special education students.
Mentioned
