The Western Cape Provincial Parliament (WCPP) says it has suffered a data leak, compromising some or all of its data.
This comes after the WCPP last month confirmed a cyber attack on its ICT systems.
At the time, the provincial legislature did not divulge the nature and extent of the cyber attack, only stating “no WCPP business will be affected”.
It said the matter has been reported to the South African Police Service and the State Security Agency.
However, in a statement issued today, the WCPP says despite making progress restoring its ICT infrastructure, forensic auditors have advised that a worst-case-scenario assumption should be adopted in respect of whether its data has been compromised by the cyber attack.
It states: “To this end, the WCPP is proceeding on the assumption that some or all of its data has or may have been leaked.
“This also applies to personal information, such as names, e-mail addresses, telephone and cellphone numbers, identity numbers, bank account information and financial statements, held by the WCPP.”
According to the WCPP, the incident creates a heightened risk for the abuse of personal information.
Under the Protection of Personal Information (POPI) Act, SA’s data privacy law, organisations that suffer data breaches are mandated to report the incident to the Information Regulator.
Breaching the rules and regulations outlined by the POPI Act can have serious financial implications for the business, which can cost more than money and have long-lasting consequences.
The Act makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.
In February, Information Regulator chairperson Pansy Tlakula told ITWeb it had received over 564 notifications of data breaches or security compromises, saying SA is one of the countries in the world with the highest rate of data breaches.
In the WCPP’s statement, it advises stakeholders, including participants in WCPP events, media representatives, members of the Cape Town consular corps, job applicants and service providers, to exercise vigilance in respect of their personal information.
“Unfortunately, we do not know what or whose personal information may have been breached. We understand that any access of personal information is concerning and we therefore encourage all our stakeholders to follow the practical advice provided above and to be extra-vigilant.
“The WCPP is working tirelessly to address the security concerns caused by the cyber attack and to reduce any risks to our stakeholders.”
It also advises stakeholders to consider the following to protect their identity and improve personal security:
- Change the passwords for all critical online accounts, particularly those related to finances and containing sensitive information. Enable two-factor authentication wherever possible. Do not use the same password for online accounts. Do not use easily guessable passwords.
- Actively monitor bank accounts and statements. Keep a close eye on bank and credit card statements for any unauthorised transactions or suspicious activities. Report any anomalies to financial institutions promptly.
- Be cautious of phishing attempts. Scammers may try to exploit the situation by sending phishing e-mails or making fraudulent calls. Be vigilant and avoid clicking on suspicious links or providing personal information over the phone unless certain of the caller’s authenticity.
- Pay special attention to online profiles (including Facebook, Twitter and LinkedIn) and be cautious of strangers contacting you unexpectedly, even if they seem to know quite a bit about your personal circumstances (social engineering techniques).
- Consider identity protection services (for example, TransUnion). These services can help monitor personal information and notify you in the event of potential incidents or applications for credit using your personal details.
- Ensure communication devices, including computers and smartphones, have up-to-date security software and operating systems. Regularly apply patches and updates to minimise vulnerabilities.
Share