Maccabi Health Services Fined $256,000 for Delayed Reporting of Data Breach Exposing Patient Records

Maccabi Health Services was fined 256,000 shekels by Israel's Privacy Protection Authority for failing to promptly report a serious data breach that allowed insured members to access sensitive medical information of their relatives. The breach was discovered in November 2025 after a member reported being able to view his stepsister's medical records, which should have been inaccessible. Subsequent investigation revealed a widespread digital system flaw that, under certain conditions, permitted unauthorized access to personal and sensitive medical data of many insured individuals.

Although Maccabi identified the breach in November, it only reported the incident to the Privacy Authority in January 2026, nearly two months later. The health fund completed a fix for the vulnerability by the end of January. The Authority launched an administrative inquiry due to the delayed notification, concluding that Maccabi violated the legal obligation for immediate reporting under Amendment 13 to the Privacy Protection Law.

The Privacy Authority emphasized that organizations must report suspected unauthorized access immediately upon discovery, even if investigations are ongoing, with missing details to be provided later. Gilad Samama, head of the Authority, stated that violations after Amendment 13's enactment carry significant financial penalties, as demonstrated in this case. Enforcement manager Adi Menachem Bar added that the Authority will continue to rigorously enforce compliance and reject any interpretations undermining the immediacy requirement.