The South African Banking Risk Information Centre (Sabric) industry body is co-ordinating with the banking sector to ensure South Africans’ personal information is not abused by the hackers that broke into the IT systems of credit bureau TransUnion.
Last week, ITWeb broke the news that the hacker group, going by the name N4ughtysecTU, which claims to hail from Brazil, breached TransUnion and accessed 54 million personal records of South Africans.
The group claimed the credit bureau was using the word “password” as its password.
Information bureau TransUnion South Africa confirmed that N4ughtysecTU obtained data belonging to the bureau through the misuse of an authorised client’s credentials.
In a statement, Sabric says the personal information obtained could include names and ID numbers.
In a video interview with ITWeb on Saturday, the hacker group, which is demanding a $15 million (R223 million) ransom from TransUnion, threatened to use the stolen data for espionage and social engineering.
In the context of information security, social engineering is the psychological manipulation of people into performing actions or divulging confidential information.
The hackers say they will continue leaking the data if their demands are not met, with the credit bureau vowing not to pay them a cent.
Take precautions now
Says Sabric CEO Nischal Mewalall: “Sabric has already engaged TransUnion South Africa with the aim to coordinate the banking industry’s efforts to secure bank customers’ profiles against abuse.”
According to Sabric, South African banks take the security of their customer data very seriously and have put in place robust risk mitigation strategies to detect potential fraud on accounts and protect customers’ personal information, as the investigation unfolds.
Mewalall adds the compromise of personal information does not guarantee access to a customer’s banking profile or account, but criminals can use this information to impersonate people or trick them into disclosing their confidential banking details.
Sabric urges bank customers and other consumers to follow sound identity management practices to mitigate the risk of identity theft and fraudulent applications, and recommends that bank customers follow these precautionary measures:
- Do not disclose personal information such as passwords and PINs when asked to do so by anyone via telephone, fax or even e-mail.
- Change your password regularly and never share it with anyone else.
- Verify all requests for personal information and only provide it when there is a legitimate reason to do so.
- Do not use the information that may have been compromised. Rather use other personal information that you have not used previously to confirm your identity in future.
Meanwhile, the Southern African Fraud Prevention Service (SAFPS) says this alarming news is further indication that every company that holds personal information is a potential target.
“The consumer desperately needs an extra layer of protection on their identity against criminals who will turn their lives upside down without a second thought,” says Manie van Schalkwyk, CEO of SAFPS.
“How significant is the risk? It is estimated that there are 17 billion cyber attacks that take place around the world every day, not all being successful.”
SAFPS notes that over the past two years, South African companies have been reporting they have been victims of cyber attacks and data breaches.
It notes that some of these breaches included the compromise of consumers’ personal information.
“No organisation is immune against cyber attacks and the Department of Justice recently announced it was a victim of a cyber crime. In a separate incident, Debt-IN Consultants, a professional debt recovery solutions partner to many South African financial services institutions, announced on 22 September that a ransomware attack by cyber criminals resulted in a significant data breach of consumer and employee personal information,” says the organisation.
“Data breaches have been on the rise globally and South Africa has seen unprecedented increases in the number of cyber victims,” says Dalene Deale, executive head of Secure Citizen.
Disastrous breach
Secure Citizen was created through a collaboration with SAFPS and OneVault, in response to a rapid growth in identity theft following online fraud.
“Fraudsters do not discriminate. As we continuously move towards the adoption of a digital and more importantly ‘touchless’ era, the platform for fraud increases. Fraud is a fraudster’s business and they often use the same business tactics we use in legitimate business, the difference being that they don’t have customers, they have victims.
“Thanks to an increase in data breaches, fraudsters are motivated and armed with the correct information, meaning they are very capable of impersonating an individual. The impacts of this are catastrophic,” says Deale.
Van Schalkwyk points out that the TransUnion breach is concerning as the records of 54 million South Africans may have been compromised.
“In a country where identity fraud is common practice, this is extremely concerning. It is critical that consumers act now before significant fraud is unknowingly committed on their behalf.
“After the last significant data compromise in 2020, where more than 20 million records were compromised with another credit bureau, the SAFPS saw a rise of impersonation of more than 300%,” says Van Schalkwyk.
Share