Old Mutual: Client Data Exposure Prompts POPIA Notification

• Old Mutual client data, specifically mobile numbers and email addresses, was potentially exposed due to a service provider's configuration error.
• This incident was not a cyberattack, and there is no evidence of unauthorized access or misuse of the information.
• Old Mutual proactively notified affected clients as a precautionary measure, fulfilling its POPIA obligations.
• The company confirmed that clients' policies, benefits, and accounts remain secure and unaffected.
• The issue has been resolved, and enhanced safeguards have been implemented to prevent recurrence.

This incident highlights a critical aspect of South Africa data protection compliance, particularly for large financial institutions like Old Mutual: the extended responsibility for data security across their entire ecosystem, including third-party service providers.

An incident at a service provider for Old Mutual led to the potential exposure of personal information belonging to some of its clients. The data involved was limited to mobile numbers and email addresses, or a combination of both. Crucially, this was not the result of a cyberattack, but rather stemmed from a configuration error within the service provider's systems. This error meant that certain files, which should have been protected by specific security controls, became potentially accessible.

Old Mutual has clarified that there is no indication whatsoever of any unauthorized use of this information, nor any evidence of hacking, malware, or attempts to bypass security measures. The financial services provider also confirmed that clients' policies, benefits, and accounts remained entirely secure and unaffected by this Old Mutual service provider data error. Furthermore, some records that were part of the incident contained only free-text responses and did not include personal information related to identifiable individuals. The issue has since been resolved, and measures have been implemented to enhance safeguards against any future recurrence of such an event.

In response to the Old Mutual client data exposure, the company proactively communicated with potentially affected customers as a precautionary measure. This notification was undertaken in accordance with its obligations under South Africa's Protection of Personal Information Act (POPIA), demonstrating a commitment to POPIA data incident notification ZA requirements. Alongside this communication, Old Mutual issued a warning to its clients, advising them not to share sensitive credentials such as PINs, passwords, or one-time passwords, reinforcing general security best practices.

The financial institution underscored its serious commitment to protecting customer personal information and expressed regret for any concern the incident may have caused. Despite the nature of the exposure being a configuration error rather than a malicious breach, the company's swift action to inform clients and address the underlying issue aligns with the principles of transparency and accountability expected under data protection regulations. The fact that no evidence of unauthorized access or misuse has been found is a significant aspect of the incident's resolution.

This incident highlights a critical aspect of South Africa data protection compliance, particularly for large financial institutions like Old Mutual: the extended responsibility for data security across their entire ecosystem, including third-party service providers. Even when an Old Mutual personal information leak is not a direct cyberattack but a configuration error, the potential for sensitive data exposure remains. This underscores the ongoing obligation for entities to ensure robust data security measures are not only in place internally but also rigorously enforced and audited with their service providers.

The event serves as a reminder that proactive incident response protocols are essential for POPIA compliance, even in scenarios where the exposure is due to an internal system misconfiguration rather than external malicious activity. For the financial services sector, maintaining the integrity and confidentiality of client data is paramount, and any financial services data security breach, regardless of its cause, necessitates a comprehensive and compliant response to maintain public trust and adhere to regulatory mandates. This incident reinforces the need for continuous vigilance and stringent oversight of all systems handling personal information.

This incident underscores the ongoing obligation for South African entities, particularly in financial services, to ensure robust data security measures extend to their service providers and to maintain proactive incident response protocols for POPIA compliance, even when an exposure is due to configuration error rather than a cyberattack.

Source: Reporting based on company disclosures.