The growing third-party cyber risk has been brought into sharp focus by a fresh wave of incidents involving some of South Africa’s best-known financial and telecommunications brands.
EasyEquities, Satrix and Cell C have all warned customers about potential exposure of personal information following incidents involving third-party providers, while Alexforbes has also disclosed a cyber incident affecting its environment.
The incidents show the attack surface facing South African organisations is no longer confined to their own infrastructure.
EasyEquities and Satrix have said their investment platforms were not compromised, with the exposure linked to a third-party verification provider. Cell C, meanwhile, says its potential customer-data exposure relates to a separate third-party.
“Alexforbes can confirm a data security incident involving one of the company’s third-party suppliers, RelyComply, which provides Alexforbes with specialist services relating to anti-money-laundering, customer screening and risk assessment,” says the company in a statement to ITWeb.
“Regrettably, preliminary investigations confirm that some identity-related information of Alexforbes’s clients may have been accessed by a malicious threat actor as a result of this cyber incident.”
According to the company, its own internal IT systems, financial platforms and networks remain secure and uncompromised.
It adds that this incident occurred exclusively within the third-party supplier’s IT environment.
It says from the moment Alexforbes was alerted to this situation, it mobilised its incident response team to contain and manage the incident.
Alexforbes says it immediately suspended all data sharing and operations with third-party supplier RelyComply following the incident.
The financial services group points out that screening services were subsequently reinstated after forensic sign-off, completion of the required security checklist and replacement of access credentials.
Alexforbes adds it has formally notified the relevant regulatory authorities about the incident.
Meanwhile, RelyComply has appointed independent forensic specialists to investigate what happened and remains engaged in an ongoing investigation.
Alexforbes notes it remains in close contact with the supplier and is monitoring developments as further information emerges.
Unauthorised party
In a note to customers, investment platform EasyEquities says a security incident at a third-party service provider that supports parts of its client identification and verification processes did not involve unauthorised access to its own or parent company Purple Group’s systems.
The provider confirmed on 10 September that an unauthorised party had gained access to its environment, prompting EasyEquities to activate its incident response process and disable the integration the following day.
According to EasyEquities’ note to customers, personal information potentially affected includes clients’ full names, identity information, dates of birth, gender, nationality, country of residence and account numbers.
The company says its internal investigation found no evidence of compromise within its systems, while a 30-day retrospective threat hunt identified only reconnaissance activity that was blocked by perimeter controls.
EasyEquities adds that it rotated affected keys and API tokens, engaged independent cyber security specialists, increased monitoring and reported the incident to the Information Regulator under the Protection of Personal Information Act.
It warns affected customers to be alert to phishing, impersonation, scam calls and other fraudulent attempts using their personal information, and advised customers not to share credentials or personal information with anyone claiming to represent the company.
No direct link
According to Cell C, the incident did not originate within its systems. “It occurred within the environment of a third-party service provider, where an associated party accessed certain customer information via a platform used by that provider.”
According to the mobile network operator, this incident is unrelated to the RelyComply matter. “Cell C’s third-party provider is a separate entity, and this incident is not connected.
“Cell C activated its incident response procedures immediately and is working with the provider. While investigations are ongoing, protecting our customers remains our priority.”
Yesterday, ITWeb reported that insurer Hollard rejected claims that its IT systems were hacked, saying a threat actor’s allegations stem from a cyber incident at a third-party service provider.
This, after a threat actor called “The Gentlemen” claimed on the dark web that it had compromised Hollard’s systems.
The third-party service provider, MIP Holdings, confirmed the breach, saying it happened in June.
MIP Holdings provides policy administration, customer relationship management and related technology to insurers, healthcare providers, lenders, pension administrators and business process outsourcing companies.
The company notified affected stakeholders of the cyber attack, in which personal information linked to customers of about 45 South African insurance companies was compromised.
Taking responsibility
Jason Jordaan, principal forensic scientist at DFIR Labs, yesterday told ITWeb that outsourcing the processing of personal information does not remove an organisation’s responsibility to protect that information. “Third-party cyber security risk cannot simply be treated as somebody else’s problem.”
He notes that organisations need to conduct proper due diligence and ensure service providers have adequate security controls.
Jordaan warns that third-party providers can become attractive targets because they may hold large amounts of sensitive information belonging to multiple organisations and their customers.
“This means an organisation can have strong security within its own environment but still suffer a data breach because of weaknesses at a supplier.”
Share
