South Africa: Third-Party Data Breaches Surge, Exposing Major Firms

• A South African ISP, Sanlam, Liberty Group, Profmed, and Rectron have all experienced cyber incidents originating from third-party compromises.
• The 2025 SecurityScorecard Global Third-Party Breach Report indicates 35.5% of data breaches stem from third-party compromises, a 6.5% increase from the prior year.
• Companies' reliance on external service providers for core functions creates numerous, often simple, entry points for attackers.
• Effective mitigation strategies include zero-trust principles, multi-factor authentication, network segmentation, and robust contingency planning for vendors.
• South African organizations face significant POPIA compliance risks from third-party breaches, necessitating strengthened vendor contracts and rigorous security due diligence.

Rigorous due diligence on vendor security practices is no longer optional; it is a critical component of proactive risk management.

A South African internet service provider experienced a ransomware attack in April, attributed to the Krybit group, which issued threats to disclose sensitive information if its demands were not met. This incident highlights a growing vulnerability within the nation's digital infrastructure. In a separate development in July, financial services giant Sanlam disclosed that personal client data, including names, ID numbers, email addresses, and contact details, had been compromised through a breach at one of its external service providers.

These incidents are not isolated, as several other prominent South African entities have faced similar challenges in 2026. Liberty Group, for instance, confirmed "unauthorised third-party access" to its systems in March of that year. Profmed, a medical scheme administrator, saw the records of over 200,000 members exposed in June after attackers successfully compromised login credentials at a supporting third-party provider. Furthermore, Rectron, a crucial distributor in the supply chain for various resellers and vendors, including Acer South Africa, endured a week-long offline period in July following a cyber attack, which it subsequently reported to the South Africa Information Regulator. These events collectively underscore a significant and escalating threat originating from third-party relationships.

The increasing frequency of these incidents reflects a broader global trend where external suppliers serve as common entry points for cyber attackers. According to the 2025 SecurityScorecard Global Third-Party Breach Report, a substantial 35.5% of all data breaches originated from compromises within third-party systems, marking a 6.5% increase from the preceding year. This surge is largely attributable to modern enterprises' escalating reliance on a diverse array of third-party service providers and solutions for core business functions.

From cloud providers hosting email services and hosted CRM environments managing customer records, to subcontractors developing systems and external providers handling maintenance, businesses are deeply intertwined with numerous external entities. While these relationships are standard in contemporary operations, companies frequently fail to ensure that their third-party suppliers uphold stringent security controls. Attackers often exploit surprisingly simple vectors; for example, a compromised third-party contractor, perhaps one hired for office renovations, could send an infected invoice to the primary company, leading to a breach once opened. The infection bypasses traditional perimeter defenses like firewalls and endpoints, instead leveraging established trust within the supply chain. This vulnerability is further evidenced by SecurityScorecard's finding that 41.4% of ransomware attacks originate through a third party.

Addressing this evolving threat requires a fundamental shift in how organizations approach trust and security within their extended ecosystems. Simply demanding extensive paperwork from every vendor often proves ineffective, fostering apathy and a "box-ticking" mentality that fails to genuinely enhance security posture. Instead, a more dynamic approach is necessary, where security standards are scaled appropriately for each supplier, guided by zero-trust principles specifically tailored for third-party connections.

Key measures include enforcing the principle of least privilege, implementing multi-factor authentication (MFA) for all vendor logins, and utilizing identity-aware proxies to control access. Furthermore, robust network segmentation is crucial, involving the placement of contractor and vendor access on distinct VLANs or separate cloud accounts. This strategy significantly minimizes the risk of a compromised vendor gaining lateral movement into the core network. Organizations must also develop comprehensive exit strategies and contingency plans for high-risk third parties, acknowledging that incidents are not a matter of "if," but "when." Investing in proportionate governance is the essential fix, as attackers will continue to target the path of least resistance, ensuring third parties remain a significant risk for the foreseeable future.

The pervasive nature of third-party data breaches carries significant implications for South African organizations, particularly concerning compliance with the Protection of Personal Information Act (POPIA). The exposure of sensitive client information, as seen in the Sanlam data breach and Profmed data exposure, directly triggers POPIA compliance exposures, potentially leading to regulatory scrutiny and penalties from the South Africa Information Regulator. The Rectron cyber attack, which was reported to the Information Regulator, further underscores the regulatory expectation for prompt disclosure and accountability in such incidents.

In light of this escalating risk, legal and compliance professionals in South Africa must urgently re-evaluate and fortify their organizations' third-party vendor contracts. These agreements should incorporate robust data security clauses that clearly define responsibilities, security standards, and incident response protocols. Rigorous due diligence on vendor security practices is no longer optional; it is a critical component of proactive risk management. Furthermore, incident response plans require updating to specifically address scenarios where breaches originate from third parties, ensuring swift and effective mitigation to avert potential litigation and safeguard organizational reputation.

Lawyers and compliance officers in South Africa must urgently review and strengthen their organizations' third-party vendor contracts to include robust data security clauses and ensure rigorous due diligence on vendor security practices. The increasing trend of third-party-originated breaches necessitates updated incident response plans and proactive risk management to mitigate POPIA compliance exposures and potential litigation.

Source: Original reporting via Armata Cyber Security analysis