Legal News
South Africa: Escalating Third-Party Cyber Risk Leads to Breaches
South African businesses, including an ISP, Sanlam, Liberty Group, Profmed, and Rectron, have experienced significant data breaches and cyberattacks originating from compromises at their third-party suppliers, as highlighted by Richard Frost of Armata Cyber Security in an ITWeb report. These incidents, which occurred in 2026 and earlier, involved the leakage of sensitive client information such as names, ID numbers, emails, and contact details, demonstrating a growing trend where third-party vulnerabilities are exploited to gain access to enterprise systems and data.
This trend is critically important for South African legal practitioners and businesses, as it underscores the escalating legal, financial, and reputational risks associated with third-party vendor relationships, particularly concerning data protection and cybersecurity. The reported breaches demonstrate that an organisation's security posture is only as strong as its weakest link in the supply chain, making robust third-party risk management an indispensable component of overall enterprise risk strategy. The financial and reputational fallout from such breaches can be severe, impacting customer trust and potentially leading to regulatory penalties.
The primary legal framework governing these incidents is the Protection of Personal Information Act (POPIA) 4 of 2013, which imposes strict obligations on responsible parties (including businesses) to protect personal information, even when processed by operators (third-party suppliers). POPIA mandates that responsible parties ensure operators establish and maintain appropriate security measures. Failure to do so can lead to significant penalties, including administrative fines up to R10 million, imprisonment, and reputational damage. Other relevant legislation includes the Cybercrimes Act 19 of 2020, which criminalises various cyber offences, and common law principles related to negligence and breach of contract. The Information Regulator is the key regulatory body overseeing POPIA compliance, to whom Rectron reported its incident.
Key parties involved include Armata Cyber Security (Richard Frost), ITWeb (source), and the affected South African companies: an ISP, Sanlam, Liberty Group, Profmed, and Rectron. The Information Regulator is also a crucial party, as Rectron reported its incident to them, highlighting the regulatory oversight in such matters. The 2025 SecurityScorecard Global Third-Party Breach Report further substantiates this trend, indicating that a significant percentage of data breaches originate from third-party compromises, underscoring the systemic nature of this vulnerability.
Attorneys must advise clients on robust third-party risk management frameworks, including comprehensive due diligence before engaging suppliers, stringent contractual clauses addressing data security, liability, and breach notification, and ongoing monitoring of supplier security postures. Businesses should conduct regular security audits of their third-party ecosystem and develop incident response plans that specifically account for breaches originating from suppliers, ensuring compliance with POPIA's notification requirements to the Information Regulator and affected data subjects. Proactive measures, such as implementing strong vendor management policies and ensuring contractual indemnities, are essential to mitigate the legal and financial exposure arising from these increasingly common third-party vulnerabilities.