Cyberattacks put South Africans’ personal data in the spotlight

South Africans are being urged to be extra careful with their personal information after cybersecurity incidents involving investment platforms EasyEquities and Satrix, as well as vehicle tracking company Cartrack.

While EasyEquities and Satrix have stressed that their own systems have not been compromised, EasyEquities confirmed that a third-party company that verifies clients experienced a security incident in which an unauthorised party gained access to its environment.

Meanwhile, Cartrack has confirmed that it was hit by ransomware and information in its customer database was accessed.

The incidents have highlighted how personal information can be exposed through companies that provide services to businesses, even when the main company’s own systems remain secure.

EasyEquities notified clients that a third-party service provider it uses for client verification had experienced a cybersecurity incident.

“As part of our client verification process, EasyEquities uses a third-party service provider to conduct verification checks in line with regulatory obligations,” the company told clients.

“We are writing to inform you that this third-party service provider has experienced a cybersecurity incident potentially affecting customer information.”

EasyEquities said an immediate forensic investigation had been launched to establish what happened and what information may have been affected.

The company also reassured customers that its own systems had not been compromised.

This is a third-party incident — it does not involve any breach of, or unauthorised access to, EasyEquities’ or Purple Group’s own systems

In response to questions from TimesLIVE, EasyEquities information officer Langelihle Nkabinde confirmed that the incident involved an unauthorised party gaining access to the third-party provider’s environment.

“This is a third-party incident — it does not involve any breach of, or unauthorised access to, EasyEquities’ or Purple Group’s own systems,” said Nkabinde.

The information potentially affected was “limited to identity verification data shared with the provider for KYC purposes”.

KYC, or know-your-customer, checks are used by financial companies to verify the identities of their clients.