Menora Mivtachim Fined NIS 256,000 for Delayed Security Breach Report

Israel's Privacy Protection Authority has fined Menora Mivtachim Insurance Ltd. NIS 256,000 for failing to immediately report a serious security incident. This marks the second time the authority has imposed financial sanctions since an amendment to the Privacy Protection Law took effect.

The authority determined that Menora Mivtachim violated the immediate reporting requirement by delaying for over two weeks a report about an incident where personal information of policyholders was exposed to an unauthorized insurance agent. The authority stressed that internal investigations or identifying the cause of the breach should not delay reporting.

The incident involved an insurance agent mistakenly gaining access to a report containing personal details of 138 policyholders belonging to another agent. This data was extracted from the company's customer database, which holds sensitive information on approximately 2 million individuals, including financial, salary, and medical data. The breach, discovered on November 12, 2025, was only reported to the authority on November 27, 2025, after the company completed its internal review.

Menora Mivtachim argued that the reporting obligation only arises after internal checks and verification of the technological failure are completed. However, the authority rejected this, stating that the immediate reporting is crucial for supervisory and control functions and that initial reports can be partial, with further details provided later.

The initial fine was NIS 640,000, but it was reduced by 60% due to factors including no prior violations in five years, the company's proactive reporting to stop the breach, and the appointment of a legal privacy officer. The authority also referenced previous fines, including NIS 256,000 to Maccabi Health Services and a violation by the Ministry of Education involving sensitive data of 21,000 special education students.