Breach Disclosure: Experian South Africa

In May 2020, Experian South Africa experienced a data breach involving 24 million South Africans and 793,749 local businesses, which was discovered by Experian in July 2020 and reported to regulators in August of 2020. According to iAfrikan, the actor responsible for the data breach had a previous relationship with Experian, and received a download link from the company to the data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

As mentioned, it was reported that Experian South Africa assumed they were dealing with a legitimate client, and handed over two sets of data for millions of South Africans. Once the actor obtained the data, they uploaded it to various websites and forums in 2 sets of data, the first one being the data on the 24 million South Africans, the other being credit or financial information.

The first set of data on the 24 million South Africans contained the following column names:

RSAID Forename1 surname CS_File_number CS_CST_HomeAffairsRSAIDVerf CS_CELL_PHONE_1 CS_CELL_PHONE_2 CS_CELL_PHONE_3 CS_HOME_PHONE_1 CS_HOME_PHONE_2 CS_HOME_PHONE_3 CS_OTHER_PHONE_1 CS_OTHER_PHONE_2 CS_OTHER_PHONE_3 CS_WORK_PHONE_1 CS_WORK_PHONE_2 CS_WORK_PHONE_3 CS_EMAIL CS_EMAIL_RANK CS_Employer CS_OCCUPATION CS_Date CS_EMP1_EMP_NAME CS_EMP1_DATE_CREATED CS_EMP1_OCCUPATION CS_EMP2_EMP_NAME CS_EMP2_DATE_CREATED CS_EMP2_OCCUPATION CS_EMP3_EMP_NAME CS_EMP3_DATE_CREATED CS_EMP3_OCCUPATION CS_Address1_Line_1 CS_Address1_Line_2 CS_Address1_Line_3 CS_Address1_Line_4 CS_Address1_Town CS_Address1_PostCode CS_Address1_Province CS_Address1_Update_Date CS_Address2_Line_1 CS_Address2_Line_2 CS_Address2_Line_3 CS_Address2_Line_4 CS_Address2_Town CS_Address2_PostCode CS_Address2_Province CS_Address2_Update_Date CS_Address3_Line_1 CS_Address3_Line_2 CS_Address3_Line_3 CS_Address3_Line_4 CS_Address3_Town CS_Address3_PostCode CS_Address3_Province CS_Address3_Update_Date

The other data set on businesses in South Africa contained the following column names:

Kim#
Debtor Name Vat Matched Flag Legal Name Alt Name Type Alt Name Name Change Type Changed Name Entity Company Status
Reg Number
Report Date
Enquiry Amount
Enquiry Terms
Bank Code
Bank Code Date Sicc Source
Sicc
Sicc Description
Employees
Holding Company
Turnover Range Import/Export
Fleet
Score
Score Comment
Judgements
R/D Cheques
Adverse References
Telephone
Postal Address
Street Address Province
Principals
Branches
Liquidation
Premises
VAT Number
Ultimate Holding Company
Last JU Date
Auditor Fax
E-mail
Bankers Account#
Branch
BEE
NCA

Both of these data sets provide an ample amount of data to hackers to be used in compromising accounts, pre-texting, or any other fraudulent activities. However, Experian stated "Our investigations also show that the suspect had intended to use the data to create marketing leads to offer insurance and credit-related services.", but due to conflicting information from Experian's investigation and the one from iAfrikan, it is unknown if this is factual.