Bottom Line (TL;DR): Israel’s Privacy Protection Authority imposed a 256,000 ILS fine on Menora Mivtachim Insurance (reduced from a 640,000 ILS base penalty) after an insurance agent inadvertently gained access to sensitive personal and financial records of 138 policyholders — and the company waited 15 days to report the incident. Under Amendment 13 to the Privacy Protection Law, strict enforcement and heavy fines apply to businesses of all sizes.
What Happened in the Menora Mivtachim Case & What Did the Regulator Rule?
Due to a permissions flaw in the company’s information systems, an unauthorized insurance agent was able to view sensitive personal records of 138 insured individuals — including ID numbers, marital status, employer details, salary data, insurance policies, and debts. The company learned of the incident following a complaint on November 12, 2025, but only reported it to the Privacy Protection Authority on November 27, 2025, after completing its internal investigation.
In its enforcement decision, the Privacy Protection Authority established two precedent-setting principles binding on every Israeli organization:
- Immediate Breach Notification Duty (No Waiting for Internal Investigations): The Authority rejected the claim that a company may finish internal technical forensics before reporting. The statutory duty to report immediately under Regulation 11(d)(1) is triggered the moment a severe incident is discovered, and a two-week delay constitutes an independent violation carrying heavy fines.
- Strict Database Access Controls: Even when records are displayed inside an isolated sub-system for a small number of customers, the required security level is dictated by the central customer database from which the data originates.
Why This Ruling Matters for Small & Medium Businesses (SMBs)
Many business owners assume privacy enforcement only targets giant insurers or banks, but Amendment 13 to the Privacy Protection Law (effective August 2025) fundamentally changed the landscape. Accounting firms, law offices, insurance agencies, clinics, retailers, and any business holding customer or employee databases are subject to strict data security and reporting duties:
- Direct Administrative Fines: The Authority can levy tens or hundreds of thousands of shekels in administrative fines for missing security controls, flawed access permissions, or delayed breach reporting.
- Enforcing Least-Privilege Access: Businesses must ensure employees and external vendors only access data strictly required for their role, backed by Multi-Factor Authentication (MFA) and audit logging.
- 24/7 Monitoring & Incident Response: Deploying managed threat monitoring (such as Guardz) detects anomalous file access, phishing, or compromised cloud accounts in real time — enabling immediate containment and timely regulatory notification.
Frequently Asked Questions (FAQ)
How quickly must a severe security incident be reported to the Privacy Protection Authority?
The law requires reporting "immediately" upon discovery. Organizations must submit an initial notification right away based on available facts and supplement it as the investigation progresses.
Unsure if your business meets Amendment 13 requirements? Contact Base2 today for a readiness assessment, access-control hardening, and managed cyber protection.