Hollard: Customer Data From MIP Hack Appears on Dark Web

• Customer data linked to insurer Hollard has appeared on the dark web following a June cyber attack on its third-party technology provider, MIP Group.
• The cyber crime group "The Gentlemen" dumped the data after reportedly demanding a ransom from Hollard and receiving an undisclosed payment from MIP Group.
• The breach at MIP Group compromised personal information from customers of approximately 45 South African insurance companies, though Hollard states the impact on its clients appears isolated to individual funeral policyholders.
• Hollard confirms the data is linked to the June 2026 MIP incident, not a breach of its own systems, and has notified affected customers and regulatory authorities.
• "The Gentlemen" operates a double extortion scheme, stealing data and encrypting files, with a global reach of over 200 victims across 50 countries by early 2026.

A cyber security researcher has independently verified that customer data associated with Hollard is now publicly accessible on the dark web.

Sensitive customer information linked to the insurer Hollard has reportedly appeared on the dark web, a hidden segment of the internet not indexed by standard search engines. This development stems from a cyber attack in June on MIP Group, a third-party technology provider to Hollard and numerous other financial services organizations. The cyber crime syndicate known as "The Gentlemen" is responsible for dumping the data, escalating the repercussions of the initial breach.

A cyber security researcher has independently verified that customer data associated with Hollard is now publicly accessible on the dark web. This digital underground is frequently utilized by criminals for trading stolen credentials, data, and other illicit goods. Reports indicate that "The Gentlemen" initially demanded a ransom payment directly from Hollard to prevent the public release of this information.

While MIP Group reportedly paid an undisclosed sum to the attackers, the syndicate has since shifted its focus to extorting money directly from MIP's clients. Hollard, in a statement to ITWeb, confirmed its awareness that information connected to a previously disclosed cyber security incident involving MIP, a service provider to various entities in the insurance sector, has been published online. The company emphasized that this information appears to be tied to the June 2026 MIP incident and does not indicate any compromise of Hollard's internal systems.

The initial cyber security incident at MIP Group, which occurred in June, potentially exposed data related to multiple financial services organizations. MIP Holdings specializes in providing policy administration, customer relationship management, and associated technology solutions to a wide array of clients, including insurers, healthcare providers, lenders, pension administrators, and business process outsourcing companies. The company confirmed that it had notified affected stakeholders about the cyber attack.

The breach at MIP Group compromised personal information linked to customers of approximately 45 South African insurance companies. Hollard has indicated that, at this stage, the matter appears to be confined to individual funeral policyholders. The insurer has already taken steps to notify customers impacted by the June 2026 incident and is actively engaging with relevant regulatory authorities regarding the data exposure.

The cyber crime group "The Gentlemen," which emerged in mid-2025, employs a sophisticated double extortion strategy. According to cyber security firm FortiGuard Labs, the group infiltrates company networks, exfiltrates sensitive data, and then encrypts the victim's files. They subsequently demand a ransom for the decryption keys, coupled with the threat of publishing the stolen data online if the payment is refused.

FortiGuard Labs speculates that "The Gentlemen" operates from Russian-speaking regions, a conclusion drawn from the group's policy of not targeting organizations within Russia or other Commonwealth of Independent States countries. By early 2026, the group's data leak site reportedly listed over 200 victim organizations across more than 50 countries on every major continent. These victims span over 20 industries, including critical sectors like energy, government, and healthcare services. The syndicate publicly advertises its tools on underground criminal forums, running what appears to be a ransomware-as-a-service (RaaS) program and offering affiliates a substantial 90% share of the profits.

Despite the data appearing on the dark web, Hollard maintains that forensic and assurance activities conducted to date have found no evidence of compromise within its own operational environment. The company's statement to ITWeb reiterated that the published information is linked to the June 2026 cyber security incident involving MIP, not a breach of Hollard's systems. This distinction highlights the critical importance for legal and compliance teams to scrutinize third-party vendor cybersecurity protocols and contractual agreements, particularly regarding data processing and liability.

As a precautionary measure, Hollard has advised its customers to remain vigilant against unsolicited communications, potential phishing attempts, and any requests for personal or financial information. This incident underscores the need for robust incident response plans that address supply chain breaches and ensure timely regulatory notification, especially concerning personal information under POPIA in South Africa, emphasizing the ongoing challenge of third-party vendor cyber risk ZA.

This incident highlights the critical importance for legal and compliance teams to scrutinize third-party vendor cybersecurity protocols and contractual agreements, particularly regarding data processing and liability. It also underscores the need for robust incident response plans that address supply chain breaches and ensure timely regulatory notification, especially concerning personal information under POPIA in South Africa.

Source: Original reporting via ITWeb