SA’s largest data breach has now been contained, says credit bureau Experian, which handed over the personal details of some 24m people to an individual it now calls a fraudster, notes a Business Insider report.

However, notes the report, it is still not clear what happened between the end of May – when Experian handed over that data – and mid-August, when that containment finally took place.

Experian confirmed yesterday that what it terms ‘the release’ took place on 24 May and 27 May.

That was when it handed over data, including ID numbers, telephone numbers, and physical and e-mail addresses of more than 23m individuals and nearly 800 000 businesses, to someone who presented themselves as authorised to have that information.

SA’s largest banks are now warning affected and potentially affected customers to exercise heightened vigilance, because that information could be used in identify theft attempts, or to convince people to hand over more information.

For all of June, July, and the first two weeks of August, customers were not aware of that possibility, though, as Experian first sought to plug the leak.

The company said it had secured the hardware the information had been stored on via an Anton Piller court order.

‘We delayed publishing the incident due thereto that the Anton Piller is reliant on the element of surprise and we therefore could not make the incident public,’ the company reportedly told Business Insider yesterday.

Experian said it had detected the breach on 22 July – 57 days after handing over the data.

The Anton Piller order was fully executed by 18 August – 84 days after the breach.

Experian said it believes ‘that the incident has been contained’, after it seized hardware from the suspected fraudster and the data was ‘secured and deleted’.

Asked why it believed the data had not been sold or otherwise passed on in three months, the company said: ‘We have been monitoring the various platforms (i.e. the dark web) to ascertain whether the data is being offered for sale. We also employed a leading digital forensic investigator to assist us with our efforts. Also, from our internal investigations we ascertained that the fraudster conducts an insurance and credit services market place and uses the information to contact consumers in order to offer services to consumers. Due to the serious nature of the Anton Piller order, we are not permitted to share any details around this.’

Full Business Insider report

Experian expects the suspect will be arrested and charged as early as today, notes a Business Day report.

It points out that according to professional services company Accenture, SA has the third-highest number of cybercrime victims in the world, with about R2.2bn lost each year through fraud carried out via the Internet. The lockdown imposed by the government to help curb the Covid-19 pandemic may have increased the prevalence of cybercrimes as more consumers moved onto digital platforms to bank and shop.

‘Since Tuesday, when we executed the search and seizure operation to obtain his devices and hardware, we have continued to build our criminal case and as soon as we lay charges tomorrow (Friday), the directorate for serious criminal offences will go and apprehend the suspect,’ says Experian Africa CEO Ferdie Pieterse.

He described the suspect as a ‘fairly smart cybercriminal’ who used sophisticated techniques to fraudulently misrepresent himself as the director of a legitimate local financial services company.

‘He had the ID number of the director of the company and all the company information. He had created a fake website of the company, complete with e-mail addresses for clerical and administrative staff. Due to the lockdown, we did not go and visit him at his place of business,’ Pieterse said

Full Business Day report (subscription needed)