Clalit Security Breach Exposed in Rape Victim Medical Records Case
Clalit security revealed that unknown callers manipulated the medical file of sexual assault victim Opal Malul via a HaEmek Medical Center employee. The implicated worker resigned, and police are investigating the breach.
A dramatic breakthrough in the investigation into the breach of the medical file of Opal Malul, a victim of sexual assault who was treated at Clalit Health Services, has revealed how unauthorized individuals gained access to her records. According to an internal security review by Clalit, the phone number linked to Malul's medical file was altered during a telephone call made by unknown parties to an employee at the HaEmek Medical Center in Afula.
Clalit transferred the findings to the Migdal HaEmek police station, which is handling both the original rape complaint and the unauthorized database breach. The hospital employee involved was summoned for police questioning and subsequently resigned from her position at Clalit. The compromised phone number matches the one used two months prior by an unidentified woman who impersonated Malul to alter her profile at a neighboring kibbutz clinic in Ramat David—an attempt that was successfully thwarted by the alert clinic staff at the time.
Following the incident, Malul and her legal counsel, attorney Gideon Costa, sharply criticized the ongoing police investigation, noting a lack of arrests or formal indictments in the sexual assault case. Malul expressed profound concern over the security breach, emphasizing that the intruders accessed sensitive medical records, including prescriptions, doctor summaries, diagnoses, and lab results, in an attempt to undermine her credibility and obstruct justice.
Attorney Costa called for the investigation to be transferred to a national fraud unit, citing a pattern of intimidation and criminal behavior directed at witnesses and the victim. Clalit stated that it views the incident with utmost gravity, has blocked the unauthorized access, reported the breach to the Privacy Protection Authority, and is fully cooperating with law enforcement agencies.
