Banks have responded quickly to yesterday evening’s news of a massive data breach at credit bureau Experian, which potentially exposed the personal details of 24-million South Africans consumers and almost 1-million businesses.
FNB has sent out a statement confirming that it is working with Sabric, the Banking Association of South Africa (BASA), law enforcement and regulatory authorities to mitigate any potential risks on its customers as a result of the incident.
It advises customers to be extra vigilant and follow recommended security precautions, which can be found on the Security Centre on the FNB App and online banking.
The bank is communicating directly to customers who may have been impacted from a banking perspective.
Standard Bank has also sent mails to customers who may be at risk, alerting them to the breach and offering advice on how to mitigate its effects.
“We have proactively stepped up our authentication processes and our fraud prevention and detection strategies to protect our clients,” Standard Bank states. “As our measures are security sensitive, we are unfortunately not able to divulge more details.
“We understand the anxiety that this will cause for our clients and wish to assure them that we are doing everything possible to protect them during this difficult time.”
The bank advises customers to change their passwords on digital banking platforms and social media; register for DigiMe on the banking app; register for transaction notification; contact the bank if they suspect a breach; protect passwords and PINs; and register with SAFPS for protective registration.
The breach, which came to light yesterday evening, was confirmed by Experian South Africa.
It is believed to have exposed some personal information of as many as 24-million South Africans and 793 749 business entities to a suspected fraudster.
Experian is investigating what it is calling an “isolated incident in South Africa involving a fraudulent data inquiry”.
The company says it appears that an individual, purporting to represent a legitimate client, fraudulently requested services including the release of information which is provided in the ordinary course of business or which is publicly available.
“We can confirm that no consumer credit or consumer financial information was obtained,” according to the Experian statement. “Our investigations do not indicate that any misappropriated data has been used for fraudulent purposes.
“Our investigations also show that the suspect had intended to use the data to create marketing leads to offer insurance and credit-related services.”
Experian has identified the suspect, and obtained and executed an Anton Piller order by which their hardware being impounded. The misappropriated data has been secured and deleted, the company states.
“We are continuing the legal process in this regard, including co-ordination with law enforcement and relevant authorities.”
Experian has notified the National Credit Regulator and the Information Regulator of the incident, and engaged with BASA, the South African Banking Risk Information Centre (Sabric) and the prudential authority at the SARB.
The company stresses that its infrastructure, systems and database have not been compromised.
Experian Africa CEO Ferdie Pieterse comments: “I would like to apologise for the inconvenience caused to any affected parties. Our first priority is to help and support consumers and businesses in South Africa.”
Sabric and the South African Fraud Prevention Services (SAFPS) have issued a statement alerting bank customers to the breach and advising them that their banks will communicate on who could be affected and what is being done to protect them.
“The compromise of personal information can create opportunities for criminals to impersonate you but does not guarantee access to your banking profile or accounts,” says Sabric CEO, Nischal Mewalall. “However, criminals can use this information to trick you into disclosing your confidential banking details.”
Mimecast cybersecurity expert Heino Gevers comments: “”It’s encouraging to see how quickly Experian made the breach public and informed the necessary authorities. Judging by their statement, swift action was taken to impound the stolen data and delete it.
“Hopefully, their quick response means no copies were made, but irrespective banking customers should be on high alert for targeted phishing and impersonation attacks via email, SMS or phone call.”
He advises that banks will be contacting their customers about the breach, but it’s important for individuals to verify the legitimacy of every piece of communication they receive.
“Do not click on links and do not hand over personal information over the phone or via electronic communication. Rather go directly to the bank’s website,” he warns.
“Mimecast’s State of Email Security 2020 report shows that 53% of South African organisations saw an increase in phishing attacks over the last year, while 46% witnessed an increase in impersonation fraud. These attacks are growing every year.
“It’s easy for criminals to register lookalike domains and launch sophisticated attacks impersonating trusted brands that are nearly indistinguishable from the real thing.
“It’s become common for malicious actors to use our favourite brands and services to trick people into handing over money or sensitive information.
“Our research shows that 84% of local organisations are concerned about a web domain, brand exploitation, or site spoofing attack. Individuals should therefore remain cyber aware at all times, irrespective of whether the information of this particular breach remains in the wrong hands at this time.”
Customers with concerns about their data are advised to regularly check their credit report by visiting www.mycreditcheck.co.za where they can access personal credit report for free, for life.