LekkeSlaap: Cyber Attack Exposes Customer Data

LekkeSlaap, a South African accommodation booking platform, recently notified customers that some booking details, including names, email addresses, and phone numbers, were accessed following unauthorised activity on its calendar-syncing system, raising concerns about potential phishing attempts.

This incident underscores the persistent and evolving cybersecurity risks faced by businesses operating in the e-commerce and hospitality sectors in South Africa. While LekkeSlaap stated that no payment information, identity numbers, or passwords were accessed, the exposure of even basic personal identifiers creates a significant risk of targeted phishing and social engineering attacks against customers. This can lead to financial losses for individuals, reputational damage for LekkeSlaap, and potential regulatory scrutiny, highlighting the critical importance of robust data protection measures.

The primary legal framework governing this incident is the Protection of Personal Information Act (POPIA). LekkeSlaap's actions, such as detecting the unauthorised activity, containing the incident, and notifying affected customers about the specific data accessed, are directly relevant to its obligations under POPIA, particularly Section 19 (security safeguards) and Section 22 (notification of security compromises). The Information Regulator would likely assess the adequacy of LekkeSlaap's security measures and the timeliness and completeness of its breach notification. The Electronic Communications and Transactions Act (ECTA) also provides a general framework for electronic transactions and data security, but POPIA is the more specific and stringent legislation for personal data protection.

Key parties involved include LekkeSlaap, the accommodation booking platform, and its affected customers whose booking details were compromised. The Information Regulator is a crucial oversight body that would likely be involved in assessing LekkeSlaap's compliance with POPIA. The article also mentions a separate data breach at NightsBridge, another South African accommodation technology provider, indicating a broader vulnerability within the industry.

Practising attorneys should advise clients, particularly those in the e-commerce, travel, and hospitality industries, to conduct immediate and thorough reviews of their data security protocols, with a specific focus on third-party integrations and calendar-syncing systems. It is crucial to ensure robust POPIA compliance, including comprehensive incident response plans, clear and transparent communication strategies for data breaches, and regular employee training on identifying and mitigating phishing and social engineering tactics. Businesses should also review their cyber liability insurance policies and ensure that contractual agreements with third-party service providers adequately address data security, breach notification responsibilities, and liability for data compromises.