Guardrisk has moved to distance itself from the MIP Holdings cyber breach, saying neither it nor parent company Momentum Group has any exposure to the technology provider.
In a statement to ITWeb, the insurer says it was aware of reports that the ransomware group The Gentlemen is claiming to have breached Guardrisk’s IT systems.
However, it says its current assessment has found no indication that Guardrisk’s systems or client data were compromised.
“Note that Momentum Group and Guardrisk have no exposure to MIP Holdings and based on our current assessment, the group has not been impacted,” the company says.
The statement follows the disclosure of a major cyber incident at MIP Holdings, a technology provider to the financial services sector.
MIP said the incident, detected in June, involved its third-party Jira project management environment and resulted in attackers accessing certain FTP/SFTP sites using credentials obtained from Jira.
The company said its core systems and client policy administration databases were not compromised, but personal information linked to customers of about 45 South African insurance companies may have been exposed.
MIP identified the attacker as The Gentlemen and notified the Information Regulator under section 22 of the Protection of Personal Information Act.
ITWeb subsequently reported that The Gentlemen claimed to have compromised Hollard. Hollard rejected the claim that its own IT environment had been hacked, saying the allegations appeared to stem from the MIP incident, which involved the insurer’s third-party service provider.
The situation escalated when data linked to Hollard was subsequently posted on the dark web following the MIP breach.
According to Guardrisk, one of its binder holders, administering about 6 000 funeral policies, was exposed in the MIP-related incident.
The binder holder has notified the Information Regulator and affected clients, Guardrisk says.
A binder holder is an authorised third-party that can market and administer insurance products on behalf of an insurer, while the insurer remains the underwriter.
Guardrisk stresses that the exposure of the binder holder does not mean its own systems were breached.
“However, Guardrisk itself has no exposure to the breach,” it says.
The development again highlights the risks posed by third-party technology and service providers to South African organisations.
Guardrisk says it will continue monitoring developments and maintaining its security measures.
“We remain vigilant, continue to monitor developments closely, and maintain appropriate security measures to protect our clients and business operations,” the insurer says.
Share
