EasyEquities, Satrix: RelyComply Data Breach Impacts South Africa

• EasyEquities and Satrix reported a potential personal information compromise at their third-party service provider, RelyComply, which conducts regulatory verification checks.
• The core trading and investing systems of EasyEquities and Purple Group Limited were not affected, and client funds remain secure.
• A forensic investigation is ongoing, with EasyEquities collaborating with RelyComply, and final findings are pending.
• This incident highlights the growing third-party cyber risk in financial services, echoing a similar breach at Standard Bank earlier this year.
• The Protection of Personal Information Act (POPIA) mandates reporting such data breaches to the Information Regulator in South Africa, underscoring compliance obligations.

The legal and regulatory landscape in South Africa, particularly under the Protection of Personal Information Act (POPIA), places significant responsibilities on organizations handling personal data.

EasyEquities and Satrix have recently informed their clients about a potential compromise of personal information, stemming from an incident at a third-party service provider. The breach occurred at RelyComply, a vendor relied upon by EasyEquities to conduct essential verification checks that align with regulatory obligations. While the initial communication from EasyEquities was somewhat general, subsequent details from Satrix clarified the involvement of RelyComply in this EasyEquities Satrix RelyComply data breach South Africa.

Crucially, both financial service providers have emphasized that their core trading and investing systems, including those of EasyEquities and its parent company Purple Group Limited, were not compromised. An internal investigation conducted by EasyEquities found no evidence that any EasyEquities or Purple Group Limited systems were affected, ensuring that account security and the ability to invest remain unimpaired. Clients' funds are also confirmed to be securely invested according to their original directives, mitigating immediate concerns about direct financial impact from this RelyComply personal information compromise.

Following notification of the incident, RelyComply immediately initiated a forensic investigation to ascertain the full nature and extent of the compromise and identify the specific information potentially affected. EasyEquities is actively collaborating with the third-party service provider as this investigation progresses. The final findings of this inquiry are still pending, and further communication will be issued if deemed necessary or required upon receipt of the complete investigative report. EasyEquities serves a substantial user base, with nearly 2.9 million users, 1.24 million of whom were active as of February 2026. The platform is 30% owned by Sanlam and facilitates the direct SatrixNOW platform for clients on behalf of Sanlam Investment Management.

This incident underscores a growing concern within the financial sector regarding third-party cyber risk financial services. The reliance on external vendors for specialized services, while often efficient, introduces additional layers of vulnerability. Both EasyEquities and Satrix have stated their commitment to taking cybersecurity threats seriously, conducting their own internal security checks across all entities immediately upon learning of the incident.

As a precautionary measure, EasyEquities has advised its users to remain vigilant against unsolicited emails, calls, or messages that might request personal or account information. Clients are cautioned against clicking suspicious links or sharing details with unknown parties. Furthermore, if contacted directly by anyone claiming to possess their information as a result of this incident, users are urged not to engage and to report such contact immediately to EasyEquities. Neither EasyEquities nor Satrix has disclosed the number of clients potentially affected by this particular compromise.

This event follows a similar data breach experienced by Standard Bank earlier in the year. In March, Standard Bank clients were notified of unauthorized access to select data within the bank's internal administrative and document filing systems. Standard Bank confirmed in April that its transactional banking and core operating systems remained secure and unaffected, mirroring the assurances provided by EasyEquities regarding the integrity of its core systems. These incidents collectively highlight the critical need for robust third-party vendor due diligence and continuous monitoring across the financial services landscape in South Africa.

The legal and regulatory landscape in South Africa, particularly under the Protection of Personal Information Act (POPIA), places significant responsibilities on organizations handling personal data. POPIA empowers the Information Regulator to enforce actions against contraventions of the Act, making compliance a paramount concern for all entities, especially those in the financial services sector. Incidents involving the potential compromise of personal information, such as the EasyEquities Satrix RelyComply data breach South Africa, typically necessitate reporting to the Information Regulator.

This requirement for South Africa data breach reporting obligations ensures transparency and accountability, allowing the regulator to assess the impact and ensure appropriate remedial actions are taken. The ongoing forensic investigation into the RelyComply incident will be crucial in determining the full scope of the data compromise, which will then inform the necessary reporting and potential POPIA enforcement data breach ZA actions. For companies like EasyEquities and Purple Group, maintaining stringent data security protocols and ensuring their third-party vendors adhere to similar standards is not just good practice but a legal imperative.

The incident serves as a stark reminder for legal and compliance professionals within financial institutions to critically review their third-party risk management frameworks and incident response plans. The integrity of EasyEquities Purple Group data security, even when relying on external partners, ultimately rests with the primary entity. Proactive measures, thorough due diligence, and clear contractual obligations with vendors are essential to mitigate the risks associated with data processing by third parties and to ensure adherence to POPIA's stringent requirements.

This incident underscores the critical importance of robust third-party vendor due diligence and ongoing monitoring for financial services firms in South Africa, particularly concerning POPIA compliance and data breach reporting obligations to the Information Regulator. Lawyers and compliance officers should review their third-party risk management frameworks and incident response plans.

Source: Original reporting via {source}