Dis-chem probes massive data breach
Dis-Chem has confirmed an investigation into a data breach of 3.6m people’s personal information. An EWN report notes that the company confirmed that ‘no identification numbers, medical, financial or banking information was contained in this database’.
However, the incident exposed details on names, surnames and email addresses of more than 3.6m Dis-Chem customers.
The retailer, which was made aware of the break on 1 May 2022, launched an investigation into unauthorised access by a third party, which occurred at the beginning of April 2022.
Dan Thornton, co-founder and CEO of GoldPhish, a global cyber security awareness training platform, said this was an ongoing trend South African businesses should expect to see in the future.
He added that due to the pandemic, businesses have transitioned to conducting operations online, making them more susceptible to more cyberattacks.
The data breach may also lead to reputational damage for businesses if consumers cannot trust them to protect their personal information.
Dis-Chem explained that it had contracted with a third-party service provider and operator for certain managed services.
An IT Web report notes that it said the operator developed a database for Dis-Chem, which contained certain categories of personal information necessary for the services offered by Dis-Chem.
According to the company, based on the categories of personal information impacted, there is a possibility that any impacted personal information may be used by the unauthorised party to commit further criminal activities, such as phishing attacks, e-mail compromises, social engineering and/or impersonation attempts.
For example, it cautions, it may be cross-referenced with information compromised in other third-party cyber incidents, for the further perpetration of crime against data subjects.
While investigations into the incident are still ongoing, Dis-Chem says the operator has confirmed it has deployed additional safeguards to ensure protection and security of information on the database.
Article disclaimer: While we have made every effort to ensure the accuracy of this article, it is not intended to provide final legal advice as facts and situations will differ from case to case, and therefore specific legal advice should be sought with a lawyer.
