Menora Mivtachim Fined NIS 256,000 for Delayed Data Breach Report

The Privacy Protection Authority has fined Menora Mivtachim Insurance Company NIS 256,000 for failing to immediately report a serious data security incident. The incident involved the exposure of personal information belonging to 138 policyholders to an unauthorized insurance agent. The exposed data included salary details, policy information, and debts.

Menora Mivtachim was aware of the breach on November 12, 2025, but did not report it to the authorities until November 27, after completing its internal investigation. The Authority ruled that delaying the report to complete internal checks violated the immediate reporting requirement for serious security events.

The Authority rejected the company's arguments that the reporting obligation only arises after an internal investigation and that the data was transferred to an isolated, less secure sub-system. The Authority clarified that organizations must report serious security incidents immediately upon learning of them, even if the full circumstances are not yet clear.

The initial fine proposed was NIS 640,000, but it was reduced by 60% due to the company's lack of prior violations in the last five years, its eventual voluntary report, and the appointment of a privacy officer. Adi Menachem Bar, Director of Enforcement at the Privacy Protection Authority, emphasized that immediate reporting allows the Authority to exercise its oversight powers and mitigate risks to public privacy.