Data breach at Experian, 24 million South Africans’ personal information exposed

guest · Aug 19, 2020

Data breach at Experian, 24 million South Africans’ personal information exposed
August 19, 2020
https://www.iol.co.za/business-repo...-exposed-342b8690-f43c-4657-8555-5b55b099418a

Consumer, business and credit information services agency Experian has experienced a breach of data which has exposed personal information of as many as 24 million South Africans and 793 749 business entities to a suspected fraudster.

Experian confirmed in a statement on Wednesday that the breach had been reported to law enforcement and the appropriate regulatory authorities.
Banks and SABRIC have also been co-operating with Experian in their efforts to secure the data and ensure the perpetrators are brought to book.
Click to expand...

SABRIC chief executive Nischal Mewalall said the compromise of personal information could create opportunities for criminals to impersonate another person but did not guarantee access to banking profile or accounts.

“However, criminals can use this information to trick you into disclosing your confidential banking details.”
SABRIC and SAFPS urged bank customers and other consumers to follow sound identity management practices to mitigate the risk of impersonation and fraudulent applications.
Click to expand...

guest · Aug 19, 2020

Some Standard Bank clients victims of data breach at Experian
The hack exposed some personal information of as many as 24-million South Africans and almost 800,000 businesses, says Sabric
August 19, 2020
https://www.businesslive.co.za/bd/c...k-clients-victims-of-data-breach-at-experian/

Standard Bank, the continent’s largest bank by assets, has said some of its clients are among victims of a data breach at one of the world’s top credit bureaus, while FNB and African Bank also warned their customers to be vigilant.

Experian said no consumer credit or financial information was obtained and that the suspect had planned to use the information to offer insurance and credit-related services.

“We have proactively stepped up our authentication processes and our fraud prevention and detection strategies to protect our clients,” Standard Bank said in a statement, adding that it couldn’t give more details because its measures are “security sensitive”.
FNB said it was communicating directly with customers that may have been affected while African Bank said although personal details had been accessed, banking details had not. Both warned customers to monitor their accounts for any suspicious activity.
Click to expand...

guest · Aug 22, 2020

SA banks scramble to quell Experian hack aftermath
August 20, 2020
https://www.itweb.co.za/content/LPwQ57l62PKqNgkj/pXnWJadMba7bjO1e

South African banks have activated their risk-mitigation measures following the hacking of credit bureau Experian, which left the personal details of millions of South Africans exposed.

Responding to ITWeb via e-mail following the breach, Christine Wu, managing executive for customer value management at Absa Retail and Business Bank, says after notification by Experian of a data breach, the big four bank has proactively taken risk-mitigation steps to protect its customers.
Click to expand...

Looming phishing attacks
Meanwhile, commenting on the hack, Heino Gevers, cyber security expert at Mimecast, says: “It’s encouraging to see how quickly Experian made the breach public and informed the necessary authorities.”
Gevers believes that judging by Experian’s statement, swift action was taken to impound the stolen data and delete it.

“Hopefully, their quick response means no copies were made, but irrespective, banking customers should be on high alert for targeted phishing and impersonation attacks via e-mail, SMS or phone call.
Click to expand...

guest · Aug 22, 2020

No hacking needed: Someone duped Experian into handing over data in breach affecting 24 million South Africans
August 20, 2020
https://www.cyberscoop.com/experian-south-africa-breach-sabric/

For fraudsters looking to swindle big corporations, sometimes it’s just a matter of asking.

Earlier this week, the South African division of credit reporting giant Experian revealed that someone posing as a client had tricked the firm into coughing up personal information on an untold amount of South African consumers.
It’s a reminder of the reams of personal data that credit monitoring firms like Experian and Equifax are sitting on, and the high stakes those firms face in protecting it.
Click to expand...

The firm downplayed what it called an “isolated incident” [...]
The perpetrator appeared to be looking for “marketing leads to offer insurance and credit-related services,” the firm’s statement continued. Experian South Africa CEO Ferdie Pieterse said that the fraudster already had some personal victim data in hand before approaching Experian for telephone numbers and addresses.

An Experian South Africa spokesperson did not respond to questions on how one person was able to fraudulently acquire so much data simply by posing as a client.
Click to expand...

guest · Aug 23, 2020

Experian only informed Information Regulator months after hack
August 21, 2020
https://www.itweb.co.za/content/LPp6V7rD2ebqDKQz

The Information Regulator is concerned about the hacking of credit bureau Experian, which occurred less than two months after the commencement of the Protection of Personal Information (POPI) Act.

The fundamental part of the POPI Act is that during the process of collecting personal information, organisations must provide the requisite reasons for obtaining the data and importantly ensure it’s shared with only authorised individuals.
At the moment, Experian is still not liable to the POPI Act, as organisations have till 1 July 2021 to meet the Act’s various obligations.
Click to expand...

According to Tlakula, Experian has not informed the regulator whether it has notified the affected data subjects of the security compromise or not, and has not fully complied with the notification requirements stipulated in the POPI Act and the regulator will follow up in this regard.
She points out that since its establishment in 2016, the regulator has been urging all public or private bodies which process personal information to ensure they comply fully with the POPI Act.
Click to expand...

guest · Sep 3, 2020

Experian South Africa consumer and business databases leaked online
September 1, 2020
https://www.iafrikan.com/2020/09/01...atabase-public-data-information-south-africa/

On 19 August 2020, Experian South Africa was publicly reported to have experienced a data breach. This was first made public by the South African Banking Risk Information Center (SABRIC). Experian would only, reluctantly, issue their statement saying they curtailed a data incident.

Throughout the Experian Data Breach saga, we at iAfrikan have raised some questions given how the order of events appeared to be missing some details. We have also question Experian's delay in reporting the incident and the people involved.
After investigations and a tip-off, we can confirm that the alleged Experian database as mentioned to be part of the data breach, is available on the web on publicly viewable websites and forums.
Click to expand...

Throughout the Experian Data Breach ordeal, the credit bureau has maintained that "no sensitive consumer credit or financial information was obtained by the fraudster in this incident." The phrase has also been repeated by Experian in the above statement.
However, we can confirm that this is not entirely true as a further investigation between iAfrikan and Australian security researcher, Troy Hunt, founder of haveibeenpwned, has revealed.
Click to expand...

Investigations into Experian incident continue
At the time of publishing, at least one copy of the data was still publicly available on the web for anyone with the link to download, a worrying matter which we also raised with the Information Regulator earlier on 1 September 2020.
Click to expand...

guest · Sep 3, 2020

Data has been added to Have I Been Pwned:

Experian (South Africa) accounts – 1,284,637 breached accounts

Experian (South Africa)
In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongst other person information.

Breach date: 19 August 2020
Date added to HIBP: 1 September 2020
Compromised accounts: 1,284,637
Compromised data: Email addresses, Employers, Government issued IDs, Names, Occupations, Phone numbers
Permalink
Click to expand...

Log in or Sign up

Data breach at Experian, 24 million South Africans’ personal information exposed

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Data breach at Experian, 24 million South Africans’ personal information exposed

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches