Cyberattacks put South Africans’ personal data in the spotlight - TimesLIVE

South Africans are being urged to be extra careful with their personal information after cybersecurity incidents involving investment platforms EasyEquities and Satrix, as well as vehicle tracking company Cartrack.

While EasyEquities and Satrix have stressed that their own systems have not been compromised, EasyEquities confirmed that a third-party company that verifies clients experienced a security incident in which an unauthorised party gained access to its environment.

Meanwhile, Cartrack has confirmed that it was hit by ransomware and information in its customer database was accessed.

The incidents have highlighted how personal information can be exposed through companies that provide services to businesses, even when the main company’s own systems remain secure.

EasyEquities notified clients that a third-party service provider it uses for client verification had experienced a cybersecurity incident.

“As part of our client verification process, EasyEquities uses a third-party service provider to conduct verification checks in line with regulatory obligations,” the company told clients.

“We are writing to inform you that this third-party service provider has experienced a cybersecurity incident potentially affecting customer information.”

EasyEquities said an immediate forensic investigation had been launched to establish what happened and what information may have been affected.

The company also reassured customers that its own systems had not been compromised.

In response to questions from TimesLIVE, EasyEquities information officer Langelihle Nkabinde confirmed that the incident involved an unauthorised party gaining access to the third-party provider’s environment.

“This is a third-party incident — it does not involve any breach of, or unauthorised access to, EasyEquities’ or Purple Group’s own systems,” said Nkabinde.

The information potentially affected was “limited to identity verification data shared with the provider for KYC purposes”.

KYC, or know-your-customer, checks are used by financial companies to verify the identities of their clients.

The company had also rotated affected keys and API tokens (access tokens) linked to the third-party integration, brought in its managed security operations provider for heightened monitoring and conducted a 30-day retrospective threat hunt.

“No successful or active threat activity” had been identified on EasyEquities’ systems, he said, though reconnaissance activity had been blocked by perimeter controls.

EasyEquities also said it was monitoring its data, credentials and domains for suspicious activity, while affected clients were being notified directly.

The company said it was reporting the incident to the Information Regulator in terms of the Protection of Personal Information Act (Popia).

Importantly for customers, EasyEquities said investment holdings, trading information and account balances were stored on its own systems and were separate from the third-party identity verification environment.

“We have found no evidence that this data has been accessed or compromised,” said Nkabinde.

The forensic investigation into the third-party incident is still under way.

Satrix customers were also warned after the asset manager was notified of a cybersecurity incident involving RelyComply, the third-party verification service provider used by EasyEquities.

Satrix said EasyEquities is its outsourced service provider for the SatrixNOW platform and uses RelyComply as part of its client verification processes.

“There is no indication that SatrixNOW has been compromised,” the company said.

It also assured customers that there had been no impact on the security of their accounts or their ability to invest.

“Your funds remain invested as per your original directives.”

The company was working with EasyEquities while the investigation continued and a final report was still pending.

Customers of both companies were warned to be cautious of unsolicited emails, calls or messages asking for personal or account information and not to click on suspicious links.

Cartrack customers faced a different situation. The vehicle tracking company confirmed that it suffered a ransomware incident in August.

“On August 26, at about 2am, Cartrack identified an incident involving ransomware affecting certain systems,” the company said in response to questions from TimesLIVE.

Cartrack said it immediately took steps to secure its technical environment, and its platform was fully operational by 7am that morning.

It notified the Information Regulator and other relevant authorities on August 26 and published a public notice on August 28 after preliminary investigations.

As our initial investigation progressed, we identified that some customer data had been accessed and undertook further analysis to establish the nature and extent of any personal information potentially involved.

A full investigation is still under way, with the company’s technology teams working alongside independent cybersecurity experts.

“As our initial investigation progressed, we identified that some customer data had been accessed and undertook further analysis to establish the nature and extent of any personal information potentially involved,” said Cartrack.

The company has since determined that information in its customer database was accessed. “This may include personal contact information, bank account information and/or certain vehicle and driving-related data.”

The investigation is continuing to establish what information has been exfiltrated.

The incident was believed to have been carried out by the ransomware group known as “Direwolf”.

For Craig Rosewarne, MD of Wolfpack Information Risk, the incidents demonstrate a growing problem for companies that rely on outside service providers to handle sensitive information.

“This incident exemplifies a ‘digital supply chain’ or ‘hub-and-spoke’ attack,” said Rosewarne.

Instead of attacking several companies individually, he said, criminals can target one service provider that works with multiple organisations.

“By compromising a central entity that manages sensitive data for multiple clients, attackers gain significant leverage and scale through a single breach.”

Rosewarne said this showed that a company’s security could be affected by the security of its suppliers.

“An organisation’s security perimeter is only as resilient as its least secure integrated vendor.”

Companies needed to move beyond simply asking suppliers to complete annual security questionnaires and should instead carry out ongoing monitoring and technical checks.

Rosewarne also warned that companies should minimise the amount of sensitive information they share with third parties and ensure it is deleted or protected once it is no longer needed.

For consumers, he said the incidents should be a reason to be vigilant rather than panic. People whose information may have been exposed should be particularly cautious of targeted phishing attempts through SMS, WhatsApp, e-mail and phone calls. Rosewarne said consumers should:

He also recommended updating passwords and using strong multifactor authentication, preferably through an authenticator app rather than SMS one-time passwords. “This combination of data is highly valuable to cybercriminals,” said Rosewarne.

He warned that the exposure of information such as an identity number, full name, contact details and banking information could increase the risk of identity fraud, SIM-swap attacks and targeted social engineering.

“Since an ID number is permanent and cannot be reset like a password, affected consumers face a long-term risk that may persist for years.”

Rosewarne said companies also had legal responsibilities when dealing with personal information breaches. Under section 22 of Popia, responsible parties are required to notify the Information Regulator and affected data subjects as soon as reasonably possible after establishing that personal information had been compromised.

He said prompt communication was important because it allowed people to take steps to protect themselves.

For customers caught up in these incidents, the investigations by the companies and their third-party providers remain ongoing.