Menora Mivtachim fined NIS 256,000 for delay in reporting a security incident

The Privacy Protection Authority imposed a financial sanction of NIS 256,000 on Menora Mivtachim for failing to immediately report a serious security incident. The company reported the exposure of personal information of policyholders to an unauthorized insurance agent over two weeks late.

The Privacy Protection Authority imposed a financial sanction of NIS 256,000 on Menora Mivtachim Insurance Ltd. for failing to immediately report a serious security incident. The incident occurred when an insurance agent mistakenly received access authorization to a report containing personal information of 138 policyholders, who are associated with another insurance agent. The information was retrieved from the company's customer database, which is defined as having a high security level and contains information on approximately 2 million people, including financial data, salary data, and medical information. The company became aware of the incident on November 12, 2025, but reported it to the authority only on November 27, 2025, after completing internal investigations. The authority rejected the company's claim that it should wait for the completion of the internal investigation before reporting. The initial amount was NIS 640,000, reduced by 60% due to the absence of prior violations, proactive reporting, and the appointment of a privacy protection officer. Menora Mivtachim stated that this was a one-time incident that was handled immediately, and that the sanction was imposed solely due to the timing of the report.