The personal data of millions of South Africans, ‘stolen’ in one of SA's biggest data breaches, remains on the Internet, despite assurances the information had been recovered, notes the Sunday Times.

The failure to retrieve the data and resolve the leak has left 24m people and nearly 800 000 businesses potentially exposed to online fraudsters. The information, held by credit bureau giant Experian, includes data such as cellphone and ID numbers, addresses, banking and work details and e-mail addresses.

The dumping of the data on the Swiss-registered data transfer website WeSendit has prompted a scramble to plug the leak and find out who is to blame for the theft.

Consumer protection lawyer Trudie Broekmann said people should be concerned.

‘Credit bureaus list your income, assets, career history including reasons for termination, every account you have opened or loan taken, monthly instalments, payment history, every default judgment against you, your family relationships, and addresses and contact details.’

Information Regulator chair Pansy Tlakula said the uploaded included ‘the banking details of 24 838 businesses’.

‘We are trying to establish if the banking details of individuals have also been compromised,’ she said.

Digital forensic investigator Craig Pedersen said the stolen data is valuable not only because it contains phone and identity numbers, but because of the banking details.

‘Identity numbers usually sell for 15c per user. Add banking numbers, and people on the black market will pay up to $1.50 (R25) per record. These records are potentially worth millions of rands. The impact will be immense because data is never just bought once on the black market. It's sold multiple times.’

Experian spokesperson Michelle Samraj said Experian's systems had not been hacked and that the data was ‘erroneously shared with the fraudster purporting to represent a legitimate company’.

Full Sunday Times report (subscription needed)

The man accused of defrauding Experian claims he is the victim of a smear campaign by the credit bureau, according to Rapport.

Karabo Phungula (35), from Soweto, is the owner of Hi-Pixel Communications which boasts on its website that it can provide cell phone numbers for more than 19m consumers to marketers.

Phungula is quoted as saying Experian has an axe to grind with him as he allegedly hasn’t paid for information provided by credit bureau Compuscan in 2017.

Experian has since bought Compuscan.

He says the first he heard about Experian’s allegations against him was when an Anton Piller order was executed at his parents’ house which is also the registered address of Hi-Pixel.

‘I have done nothing wrong. I didn’t obtain any personal information in any unlawful way,’ Phungula said.

Full report in Rapport (subscription needed)