Menora Mivtachim Fined 256,000 NIS by Privacy Authority for Delayed Reporting
The Privacy Protection Authority fined Menora Mivtachim Holdings 256,000 NIS for failing to immediately report a severe data security incident involving 138 policyholders.
The Privacy Protection Authority in the Ministry of Justice has imposed a financial penalty of 256,000 NIS on Menora Mivtachim Holdings, following the violation of the obligation to report a severe security incident immediately. The decision was made after an administrative inquiry revealed that personal data of 138 policyholders was exposed to an unauthorized insurance agent, and that the company reported the incident to the authority only after completing its internal reviews.
Incident Details and Data Exposure
According to the authority's findings, an insurance agent inadvertently received access authorization to a report containing personal data of policyholders associated with another agent. The data was extracted from the customer database of Menora Mivtachim Holdings, which is defined as having a high security level and contains personal data of about 2 million people, including highly sensitive financial, salary, and medical information.
The exposed report included identification details, marital status, employer information, salary figures, insurance policy details, payments, and debts. The incident raised questions regarding the company's obligation to report the matter to the Privacy Protection Authority and the timeline for disclosing the exposure.
Timeline and Legal Arguments
The incident became known to Menora Mivtachim Holdings on November 12, 2025, but the report was submitted to the authority only on November 27, 2025, more than two weeks later. The authority ruled that waiting for internal reviews to be completed prior to reporting does not comply with the mandatory immediate reporting requirement set forth in the Privacy Protection Regulations.
During the proceedings, the company argued that the reporting obligation only materializes after completing internal investigations and verifying the technological failure. The authority rejected this claim, clarifying that organizations do not need to wait for internal investigations to conclude before filing a report.
The purpose of the immediate reporting obligation is to enable the authority to exercise its supervisory powers as close as possible to the time of discovery, even when the full circumstances and scope remain unknown.
Penalty Assessment and Reductions
The initial financial penalty was set at 640,000 NIS, given that the database maintains a high security level with data on over one million individuals. Following the company's arguments, the amount was reduced by a cumulative 60%, bringing it down to 256,000 NIS based on mitigating factors such as the absence of prior violations and the appointment of a qualified privacy protection officer.
