Menora Mivtachim Fined NIS 256,000 for Delayed Data Breach Report
Translated & summarized from Now 14 by baba
Menora Mivtachim Insurance Company was fined NIS 256,000 by the Privacy Protection Authority for a two-week delay in reporting a data breach affecting 138 policyholders. The breach exposed sensitive personal and financial information. The Authority stressed the importance of immediate reporting for security incidents, regardless of ongoing internal investigations.
The story in 4 lines · by baba
- Menora Mivtachim fined NIS 256,000 for delayed reporting of a data breach.
- Personal information of 138 policyholders was exposed to an unauthorized agent.
- The company delayed reporting the incident to authorities by over two weeks.
- The Privacy Protection Authority emphasized the requirement for immediate reporting of security events.
The Privacy Protection Authority has fined Menora Mivtachim Insurance Company NIS 256,000 for failing to immediately report a serious data security incident. The incident involved the exposure of personal information belonging to 138 policyholders to an unauthorized insurance agent. The exposed data included salary details, policy information, and debts.
Menora Mivtachim was aware of the breach on November 12, 2025, but did not report it to the authorities until November 27, after completing its internal investigation. The Authority ruled that delaying the report to complete internal checks violated the immediate reporting requirement for serious security events.
The Authority rejected the company's arguments that the reporting obligation only arises after an internal investigation and that the data was transferred to an isolated, less secure sub-system. The Authority clarified that organizations must report serious security incidents immediately upon learning of them, even if the full circumstances are not yet clear.
The initial fine proposed was NIS 640,000, but it was reduced by 60% due to the company's lack of prior violations in the last five years, its eventual voluntary report, and the appointment of a privacy officer. Adi Menachem Bar, Director of Enforcement at the Privacy Protection Authority, emphasized that immediate reporting allows the Authority to exercise its oversight powers and mitigate risks to public privacy.
Mentioned
