Privacy Authority Fines Meuhedet NIS 256,000 Over Delayed Breach Report

Israel's Privacy Protection Authority imposed a NIS 256,000 fine on Meuhedet after finding that the health fund failed to report a serious information-security incident immediately, the authority's first financial penalty since Amendment 13 took effect. A digital-system flaw let some members access relatives' sensitive medical information, and one member reported seeing his stepsister's file. Meuhedet learned of the incident in November 2025 but notified the authority only in January, after about two months. The fund said access was possible for only a small group and that the flaw was fixed by late January; regulators said an initial report cannot wait for a full investigation.