The Companies and Intellectual Property Commission (CIPC) has reported an “attempted security breach” that exposed the personal information of employees and clients.
In a statement last week, the CIPC says: “You are hereby notified that the CIPC noted an attempted security breach and the compromise of personal information of clients and CIPC employees, held on the CIPC records.
“Our ICT technicians were alerted, due to extensive firewall and data protection systems in place at the CIPC, to a possible security compromise and as a result, certain CIPC systems were shut down immediately to mitigate any possible damage.
“Through the diligent efforts of the ICT and information security teams, the compromise was isolated and curtailed and the relevant systems are back up and available for processing.
“Unfortunately, certain personal information of our clients and CIPC employees was unlawfully accessed and exposed.”
The CIPC is an agency of the Department of Trade, Industry and Competition in South Africa. It is responsible for the registration of companies, co-operatives and intellectual property rights (trademarks, patents, designs and copyright) and maintenance thereof.
“CIPC clients are urged to be vigilant in the monitoring of credit card transactions and only approve/authorise known and valid transaction requests,” the CIPC notes.
It says the extent of the exposure is being investigated and will be communicated as soon as possible.
“The CIPC recognises the importance of the consistent availability of our systems and the safeguarding of information that is not in the public domain, and is working actively to minimise the impact on the CIPC’s clients and employees.
“We apologise for any inconvenience caused and assure you that every reasonable step is taken to ensure all CIPC systems and platforms are safe and protected from unauthorised and/or unlawful access.”
The CIPC incident comes as South African organisations continue to suffer data breaches.
Information Regulator chairperson advocate Pansy Tlakula recently said it is “open season for security compromises in South Africa”, with the entity receiving more than 150 data breach notifications a month.
Information Regulator spokesperson Nomzamo Zondi tells ITWeb via e-mail that as of January 2024, the regulator had received 224 security compromise notifications.
The Information Regulator is mandated to ensure organisations put in place measures to protect the data privacy of South Africans under the Protection of Personal Information Act (POPIA).
Under POPIA, organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third-parties without their approval.
The Act sets down firm frameworks that companies have to abide by to avoid fines, criminal persecution and potential reputation loss. Perpetrators can face fines of up to R10 million or 10 years of imprisonment, depending on the seriousness of the breach.
According to the Information Regulator, the CIPC has notified the watchdog of the incident.
Share