Open V: Thousands of Call Recordings Exposed in South Africa

• An IT company, Open V, exposed thousands of confidential telephone call recordings and other sensitive data belonging to its client, Edge Financial Group, online.
• The exposed data, available since September 6, included medical and financial discussions, databases, usernames, passwords, and proprietary source code.
• The data leak was caused by a configuration error by Open V, making the information publicly accessible without requiring technical skills or illicit actions.
• Edge Financial Group and Discovery were notified by a media organization, expressed alarm, and committed to reporting the incident to relevant authorities.
• The incident triggers POPIA data breach notification requirements for the South Africa Information Regulator and affected individuals.

The exposed data included not only thousands of audio files containing confidential medical and financial discussions but also sensitive corporate information such as databases, usernames, passwords, and proprietary source code.

An IT firm operating out of Gqeberha, Open V, has been identified as the source of a substantial data exposure, leaving thousands of telephone call recordings openly accessible on the internet. The discovery, made on a Wednesday night, revealed that these sensitive audio files had been available for download since September 6, with recordings dating back to July 27. Open V, which has been in operation since 2006 and lists Siva Naidoo as its managing executive and Stuart Kemp as its chief information officer, advertises a range of IT services, including cybersecurity solutions, on its website.

The exposed recordings primarily originated from Edge Financial Group, a Gqeberha-based financial services company specializing in brokering medical scheme coverage. Many of the conversations involved Edge employees communicating with major medical aid providers such as Discovery and Bonitas. The content of these calls frequently delved into confidential medical and financial details, with a significant portion concerning medical scheme inquiries. The ease of access to this information was alarming; no technical expertise or illicit actions were required, as the data was exposed due to a configuration error by Open V, making it publicly available via an IP address.

The scale of the Open V call recording exposure in South Africa was considerable, encompassing over 9,000 audio files. Of these, at least 1,900 were identified as being of substantial length, indicating detailed conversations rather than brief or dropped calls. Beyond the extensive collection of audio recordings, the data leak also included other highly sensitive information. This comprised exposed databases, usernames, passwords, and proprietary source code, significantly increasing the potential risk associated with the breach.

The exposure was brought to light by a media organization using a tool called Shodan, which is commonly utilized by security consultants, students, and even malicious actors to identify publicly accessible systems. Upon being notified of the issue on a Thursday morning, Open V promptly took the site offline within approximately 30 minutes. However, instead of providing direct answers to inquiries, the company responded with a formal letter. Both Discovery and Edge Financial Group were immediately informed of the situation and expressed alarm, assuring that they would report the matter to the appropriate authorities.

The incident highlights critical compliance requirements under South Africa's Protection of Personal Information Act (POPIA). This legislation mandates that any organization discovering a data breach must notify the Information Regulator and, where feasible, inform the individuals whose personal data has been compromised. Edward Gutsche, the managing director of Edge Financial Group, confirmed that their FSCA compliance officer had been alerted and was awaiting a report from Open V to determine if further notification to the Financial Sector Conduct Authority (FSCA) was necessary. Gutsche also conveyed his frustration that a media entity, rather than Open V itself, identified the alleged breach, emphasizing the prejudice to both Edge and its clients' rights.

This Edge Financial Group data leak underscores the significant third-party data security risk inherent in outsourcing IT services, particularly when dealing with sensitive financial medical data breach ZA. While Discovery and Edge Financial Group were the entities whose data was compromised, they had no direct control over the technical configuration error that led to the exposure. The obligation for POPIA data breach notification now falls squarely on the responsible parties to ensure all legal requirements are met and affected individuals are informed, mitigating potential harm and upholding data privacy standards.

This incident underscores the critical importance for legal and compliance professionals to ensure robust data processing agreements and conduct thorough due diligence on third-party IT service providers, particularly concerning sensitive personal information. Companies must also have clear protocols for POPIA breach notification to the Information Regulator and affected data subjects, as failure to do so carries significant legal and reputational risks.

Source: Original reporting via GroundUp