Menora Insured Data Breach Leads to Fine, Customer Alert

Personal and financial information of 138 policyholders was exposed to an unauthorized insurance agent at Menora Mivtachim, according to the Israeli Privacy Protection Authority (PPA). The exposed data included identification details, marital status, employer information, salary data, insurance policy details, payments, and debts. The PPA stated that such information, if misused, could harm policyholders' privacy and create additional risks.

The incident occurred within Menora Mivtachim's systems, which hold data on approximately two million individuals. However, the PPA's investigation focused on the specific breach affecting 138 policyholders.

Policyholders concerned about whether their data was compromised are advised to contact Menora Mivtachim through official channels. They should specifically ask if their personal information was part of the security incident that occurred in November 2025. It is recommended to inquire about the specific details exposed, who accessed them, whether the data was copied or stored externally, and what measures are being taken to prevent future breaches. Keeping a written record of the inquiry is also advised.

While exposed financial and personal information does not automatically necessitate changing passwords or blocking payment methods, it warrants increased vigilance. Information about employment, salary, marital status, and insurance policies could be used by malicious actors for impersonation or fraud attempts. Policyholders whose data is confirmed to have been exposed should be particularly cautious of unexpected contact from individuals claiming to be from the insurance company and avoid providing passwords, verification codes, or financial details in response to suspicious messages or links.

Menora Mivtachim was fined NIS 256,000 for reporting the incident late to the PPA. The company was aware of the breach on November 12, 2025, but did not report it until November 27, after completing internal investigations. The initial fine was NIS 640,000, but was reduced by 60%. The PPA clarified that companies are not permitted to wait for internal investigations to conclude before reporting serious security incidents, emphasizing that initial reports are required even with incomplete information.