# Menora Mivtachim fined for late reporting of a severe security incident

**Last updated:** 2026-10-22  
**Canonical:** https://dpoisrael.com/en/updates/menora-mivtachim-fine/  
**Locale:** en-IL

---
22.10.2026

On 22 October 2026 the Israeli Privacy Protection Authority announced an administrative fine of ILS 256,000 against Menora Mivtachim. The breach was of Regulation 11(d)(1) of the Data Security Regulations, which requires immediate reporting of a severe security incident.

An insurance agent was mistakenly given access to data on 138 policyholders of another agent, including salary, policy and debt details. The company learned of it on 12 November 2025 and reported it only on 27 November 2025, fifteen days later.

The base amount was ILS 640,000. The Authority reduced it by 60% in total, of which 10% was for having properly appointed a Data Protection Officer.

For organisations, the point is timing. The duty to report starts when you learn of the incident, not when the internal investigation ends. An incident procedure should require an initial report to the Authority while the investigation is still running. A properly appointed DPO also cut the fine here in a measurable way.

The Authority's announcement (Hebrew): [https://www.gov.il/he/pages/menora-221026](https://www.gov.il/he/pages/menora-221026)