Meitav Trade Customer Details Exposed: What Happened and What to Check Now

A verification code arrives on your phone even though you did not try to log in. That is how the Meitav Trade information security incident began to emerge: on Saturday, 26 September, the company received reports of unexpected text messages. It later emerged that an outside party had extracted customers' personal details. According to the company's checks, customer funds and accounts could not be accessed, and passwords were not exposed.

This distinction matters from the outset. Personal data exposure is a real incident even without money being withdrawn, but it is not proof of a trading account takeover. For customers, the question now is which of their information was involved and how to find out without giving additional details to someone unauthorized to receive them.

What was extracted and what the company says about funds

According to Meitav's stock exchange filing dated 29 September, the extracted information included full names, identity card numbers, bank account numbers and beneficial owner details, where applicable. The company said the exposure occurred through an interface operated by an outside provider, and that access had been blocked and its use discontinued.

Meitav clarified that, to its knowledge and based on its checks, trading systems were not exposed. Financial data and identification documents were also not exposed, according to the company. These statements describe the findings Meitav reported and should be read with that attribution.

A bank account number, for example, is an identifying detail; the ability to perform a transaction requires separate authorization. Similarly, an identity card number is not a photograph of the card. This does not diminish the importance of privacy. It helps establish precisely what happened and avoid decisions based on a scenario broader than the information provided.

Why 3,000 texts do not necessarily mean 3,000 customers

The Kol Rega website reported, citing the company's statement, that about three thousand verification texts were sent during the incident. It also reported a small number of attempts to change the telephone number receiving the code, but said these attempts failed and no change was actually made.

That number describes messages sent. It does not independently establish how many different people were affected or how many data records were extracted. A message, a customer and a data record are different things and should not be treated interchangeably when assessing the incident's scale.

Receiving a code also does not fully answer what happened to an individual account. Record when the message arrived and ask the company about your specific case. Conversely, not receiving a text is no basis for independently concluding that a particular customer's information was definitely excluded from the exposure. Individual inquiries need to go through the company.

If family members hold separate accounts, each should check messages relating to them. A screenshot forwarded in a group may help establish that an incident occurred, but it does not replace an answer about the recipient's account. Avoid circulating screenshots containing verification codes or personal details.

The outside interface and the investigation after blocking it

A report on ynet described an API interface operated by an outside provider. This is a connection through which computer systems exchange information or instructions. For users, that activity happens behind the service screen; in this case, it was the focus of the exposure reported by the company.

Meitav and the provider carried out checks. The company said it enlisted an outside professional, while the provider enlisted another. According to Kol Rega, Meitav announced that it would contact customers whose information was extracted. The company also said the incident had ended and did not affect its continuing operations.

An announcement that an incident has ended concerns the handling of the exposure discovered. An individual customer inquiry answers a different question: whether their information was included. Customers can therefore continue using the service while requesting a clear answer about privacy. These requests do not conflict.

When contacting customer service, ask three simple questions: were my details extracted, exactly which details, and do I need to take any action? Request a written response and keep it with the messages received. Any further inquiry can then begin with the information already supplied.

Also distinguish an inquiry about information from a decision on continued use of the service. Before deciding, collect the explanations received, the actions requested and any unanswered questions in one place. This short record lets you compare messages without relying only on memory or headlines.

How to check a message without creating more exposure

In its public guide, the Bank of Israel explains that phishing is an attempt to obtain information through a message directing the recipient to an impersonation website. The request is sometimes presented as fixing a security problem or providing an update to protect the customer. This general explanation is relevant to caution after a data incident, but does not claim that a phishing campaign targeting Meitav customers was documented afterward.

The Bank of Israel recommends not providing identifying credentials in response to a suspicious message and checking with the company before complying or clicking a link. In practice, open the app you normally use yourself or go to a familiar service channel, rather than relying on contact details supplied in a text.

Even if the sender knows your name, focus on what they want: a code, a password, identifying details or a visit to another website. A personal‑sounding approach is no reason to skip verification. You can end the conversation and contact customer service yourself.

If you have already entered details in response to a suspicious message, promptly contact the relevant company and explain what you supplied and when. Distinguish reading a message, clicking a link and providing information: those details help explain the case and obtain appropriate guidance.

The unexpected text is the starting point, not the conclusion. A useful response begins with a brief pause, continues with independently contacting the company and ends with an answer about the specific account. That is how to establish what was exposed without turning the inquiry itself into an opportunity to disclose more information.