Four Breach Notices, One Shared Vendor

Over the weekend of 12 and 13 September, four South African financial and telecoms brands told their customers much the same thing. A third-party provider had suffered a cyber incident, an investigation was underway, and some customer data might be affected.

Bidvest Bank went first. Cell C and EasyEquities followed on the Saturday evening, in near identical wording, and none of the three named the provider. It was Peregrine Capital, reported by MyBroadband to have posted a very similar notice, that named it outright: RelyComply, a South African anti-money-laundering and KYC compliance platform used by regulated financial services providers to verify client identities under FICA.

None of these four businesses was breached. Their own systems, by their own accounts, were untouched. They are all writing to customers anyway, because they all handed the same job to the same supplier.

What has been claimed, and what is confirmed

The picture is still incomplete, so the two are worth separating.

Confirmed by the companies themselves: four firms issued notices about a third-party incident. Cell C said the records appeared limited to names, email addresses, mobile numbers and Fibre account numbers. Peregrine said the data may include name, identity or passport number, date of birth, contact details, residential address and bank account details. RelyComply has confirmed it is aware of a cyber incident and is investigating, but declined to confirm whether the four disclosures relate to it.

Claimed, and not independently verified: the Dire Wolf ransomware group posted a listing dated 9 September claiming it breached RelyComply's production databases and cloud storage, taking roughly 200GB drawn from more than twenty organisations. Ransomware gangs inflate their numbers, so treat the volumes as marketing until someone credible verifies them. Harder to dismiss is the timing, which lines up with the date Cell C gave its customers.

Dire Wolf runs a double extortion model: encrypt, steal, then threaten publication, and the listing carries a countdown. The same group listed Cartrack on 2 September, claiming 500GB. Cartrack confirmed the attack, said it had notified the authorities including the Information Regulator, and would notify affected parties once it knew what was accessed.

Nor was Dire Wolf the only group active here. A separate operation, INC Ransom, claimed a large haul from a South African KFC franchise operator, mostly employee records. This was not one crew running one campaign.

The real story is concentration, not compromise

Cartrack and the KFC operator were attacked directly. That is the risk every business plans for, however well. The four firms writing to customers were not attacked at all, and that is the case almost nobody has rehearsed.

When many companies in one regulated sector converge on a single specialist provider, that provider quietly becomes systemically important, and nobody sets out to make it so.

FICA and RICA obligations push firms towards specialist platforms. Building identity verification in-house is expensive and easy to get wrong, so buying it is the sensible decision, and nearly everyone makes it. A market full of competitors ends up sharing one point of failure, and none of them can see the others stacked up behind it.

It is not only a financial services problem. Cartrack also runs Picup, a logistics platform used by Pick n Pay's ASAP service, Dis-Chem, OneCart, Avo by Nedbank and Michelin. Cartrack says Picup was not affected here, and there is no suggestion it was. But look at the shape: five well-known brands, one platform underneath them, in a sector nobody calls concentrated. Most industries have a supplier like that, and most have never named it.

It also inverts attacker economics. Breaching one mid-sized compliance platform is far cheaper than breaching twenty banks, and the payload is better, because a KYC provider holds precisely the verified identity documents an attacker would otherwise have to assemble.

And this is the part that does not wash off. A leaked password is an inconvenience; you reset it. An ID number, date of birth, residential address and bank account number cannot be reissued. That data supports identity fraud and convincing impersonation for years, whether or not a cent ever moves.

What to actually do about it

None of this argues for bringing compliance in-house. It argues for knowing what you have outsourced, which most businesses do not.

Map your fourth parties, not just your third parties. You probably have a list of your suppliers. You almost certainly do not have a list of who they depend on. Ask each critical vendor which subprocessors touch your customer data, then look for where those names repeat across suppliers. Overlap is the thing to find.

Treat onboarding checks as a starting point, not the control. A questionnaire signed at contract time tells you about a vendor on one day, years ago. Posture drifts. That is the gap continuous monitoring closes, and why we run third-party risk management as an ongoing service rather than a once-off assessment. The wider case is in our guide to managing third-party vendor risk.

Write the notification path down before you need it. Under POPIA you remain the responsible party even when your operator was breached, so the duty to notify the Information Regulator and affected data subjects lands on you, on facts you cannot verify quickly. Decide now who drafts the notice, who signs it off, and what you will say while the vendor is still investigating. Note what these companies did: they wrote to customers before knowing the full extent, and said so plainly. That is the right instinct. A notice setting out what you know, what you do not yet know and when you will update beats a complete one that lands a fortnight late. Our POPIA compliance checklist covers the obligations; the speed with which you meet them is an incident response question.

Contract for information, not just for liability. Most vendor agreements cover who pays if things go wrong. Far fewer commit the vendor to telling you what happened in time to meet your own regulatory clock. Put a number on it at renewal: notification within a stated number of hours of the vendor becoming aware, to a named person, on a phone answered out of hours. A supplier who will not commit to a window has told you something.

A takeaway

Four companies did nothing wrong on their own networks and still spent a weekend writing to customers. That is not a story about weak security. It is a story about a dependency none of them had mapped.

The useful question is not whether your suppliers are secure. It is whether you could name, today, every outside party holding your customers' identity data, and which of your suppliers are quietly relying on the same one.

Reporting by Jan Vermeulen and Luis Monzon for MyBroadband, 7 and 13 September 2026. Details remain subject to ongoing investigation.