Pam Golding data breach raises questions

Daniel Puchert

Daniel Puchert

Journalist
Staff member
Joined
Mar 6, 2024
Messages
2,708
Reaction score
2,540
Questions about Pam Golding data breach

Several people who received notifications from Pam Golding Properties about a recent data breach say they have never been customers or interacted with the company in any way, asking how it obtained their information in the first place.

Pam Golding recently notified many people that their personal details were accessed after its customer relationship management (CRM) system, Alchemy, was accessed by an unauthorised and as-yet unknown third party.
 
Blacklisted their domain many years ago as they were clueless. Seems I have not missed anything.
 
Several people who received notifications from Pam Golding Properties about a recent data breach say they have never been customers or interacted with the company in any way, asking how it obtained their information in the first place.
Click to expand...
From a database. Were these people born yesterday?
 
I've request for years they remove my information and stop spamming me. I've had confirmations to this effect.

I received the notification my information was part of the breach.

POPI complaint to follow - not that it seems to make a difference.

(side note, this all started with a horrible estate agent who wouldn't take no for an answer, when I told her to stop phoning, and blocked her number - she rocked up demanding to see me, all while my wife was home, struggling with 3 week premature baby, and a husband (me) - completely down and locked in the bedroom with shingles)
 
xrapidx said:
I've request for years they remove my information and stop spamming me. I've had confirmations to this effect.

I received the notification my information was part of the breach.

POPI complaint to follow - not that it seems to make a difference.

(side note, this all started with a horrible estate agent who wouldn't take no for an answer, when I told her to stop phoning, and blocked her number - she rocked up demanding to see me, all while my wife was home, struggling with 3 week premature baby, and a husband (me) - completely down and locked in the bedroom with shingles)
Click to expand...
No way... I'd tell them where to get off.
 
As I suspected. The very definition of a 'spam' database:
“It was not limited to someone who transacted through the company,” the spokesperson said.

“This includes anyone with whom we have had telephonic contact regarding their enquiry or enquiries and who has then opted out — in order that we can ensure they are not contacted again via any of our offices.”
Click to expand...
 
Gordon_R said:
As I suspected. The very definition of a 'spam' database:
Click to expand...
Yep, sounds like multiple POPIA breaches to me - especially for those who had no idea their data was on the system.

Right to be forgotten Archives - POPIA

popia.co.za popia.co.za

  1. A data subject has the right to have his, her or its personal information processed in accordance with the conditions for the lawful processing of personal information as referred to in Chapter 3, including the right—
    1. to be notified that—
      1. personal information about him, her or it is being collected as provided for in terms of section 18; or
      2. his, her or its personal information has been accessed or acquired by an unauthorised person as provided for in terms of section 22;
    2. to establish whether a responsible party holds personal information of that data subject and to request access to his, her or its personal information as provided for in terms of section 23;
    3. to request, where necessary, the correction, destruction or deletion of his, her or its personal information as provided for in terms of section 24;
    4. to object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information as provided for in terms of section 11(3)(a);
    5. to object to the processing of his, her or its personal information—
      1. at any time for purposes of direct marketing in terms of section 11(3)(b); or
      2. in terms of section 69(3)(c);
    6. not to have his, her or its personal information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1);
    7. not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person as provided for in terms of section 71;
    8. to submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and
    9. to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99.
 
Willie Trombone said:
No way... I'd tell them where to get off.
Click to expand...

If I had answered the door that day I would have gone to jail.

We were renovating, and didn't have a house when the baby arrived three weeks early, she went into NICU and Discovery started fighting with me because she wasn't on our policy, and they couldn't add her because we couldn't give them her ID number, therefore they wouldn't approve it with the hospital (she was not even 24 hours old).

So in-between finishing the renovations, baby in ICU, trying to sort out Discovery, and back and forwards to the hospital - I had this woman constantly phoning to sell us a house we decided we didn't want.

When the shingles hit, it was misdiagnosed as pink eye (started behind my eye), so when they finally figured it out, I felt like I was dying. I think it was the longest two weeks of my life. (they said the shingles was most likely because of all the above)
 
xrapidx said:
If I had answered the door that day I would have gone to jail.

We were renovating, and didn't have a house when the baby arrived three weeks early, she went into NICU and Discovery started fighting with me because she wasn't on our policy, and they couldn't add her because we couldn't give them her ID number, therefore they wouldn't approve it with the hospital (she was not even 24 hours old).

So in-between finishing the renovations, baby in ICU, trying to sort out Discovery, and back and forwards to the hospital - I had this woman constantly phoning to sell us a house we decided we didn't want.

When the shingles hit, it was misdiagnosed as pink eye (started behind my eye), so when they finally figured it out, I felt like I was dying. I think it was the longest two weeks of my life. (they said the shingles was most likely because of all the above)
Click to expand...
Shingles is bad news - almost always because you're run down.
 
xrapidx said:
If I had answered the door that day I would have gone to jail.

We were renovating, and didn't have a house when the baby arrived three weeks early, she went into NICU and Discovery started fighting with me because she wasn't on our policy, and they couldn't add her because we couldn't give them her ID number, therefore they wouldn't approve it with the hospital (she was not even 24 hours old).

So in-between finishing the renovations, baby in ICU, trying to sort out Discovery, and back and forwards to the hospital - I had this woman constantly phoning to sell us a house we decided we didn't want.

When the shingles hit, it was misdiagnosed as pink eye (started behind my eye), so when they finally figured it out, I felt like I was dying. I think it was the longest two weeks of my life. (they said the shingles was most likely because of all the above)
Click to expand...

Couldn't you just call your security company and have her detained while SAPS arrived and then charged her with trespassing?
 
Mirai said:
Couldn't you just call your security company and have her detained while SAPS arrived and then charged her with trespassing?
Click to expand...

I was passed out - wife didn't even tell me until I recovered. If she ever came back I would have called armed response though.

EDIT: I despise estate agents with a passion, not Pam Golding in this case - but - we had another estate agent try and forcefully gain access to our property. Our domestic wouldn't let them in - and had to lock herself in the house. This time I called armed response, and I had to leave work in Diep River for Blouberg.

Unfortunately armed response missed them - when I got home I checked the cctv - watched them trying to climb a wall (yay for electric fence, put their hands through the post box to unlatch the door, etc) - then I noticed their branded vehicle in the driveway.

I called them up to ask wtf - the woman said they had the wrong address, and were meant to prepare the house for a show house, but "its ok because they're estate agents in the area, so it wasn't a risk". (obviously weren't very good because they only lasted a few years)
 
Last edited:
I flagged the email to follow-up at some point (which turned out to be a few minutes ago), initially I thought the breach email was a phishing scam, mainly because I didn't know that "Pam Golding Properties (Pty) Ltd" still existed after Pam herself ceased to exist (which I vaguely remembered, although I have never been a client of company itself - valued or otherwise).

“This includes anyone with whom we have had telephonic contact regarding their enquiry or enquiries and who has then opted out — in order that we can ensure they are not contacted again via any of our offices.”
Click to expand...

Dear hated estate agency company that I have never ever been a client of, I realise this is a very strange concept, but not keeping my illegally obtained personal information in your breached alchemy "database" (probably an Excel spreadsheet I'm sure that you use to turn illegally obtained and stored personal information into "gold"), is the best way of ensuring that you never ever contact me.

“It was not limited to someone who transacted through the company,” the spokesperson said.
Click to expand...

Kindly join your maker in ceasing to exist, at least your founder was useful for pushing up the daisies, as a dead company you aren't even useful as fertiliser.

1742136360778.png
 
Last edited:
So after a popia complaint, Pam Golding responded that basically they won't remove personal information because then they won't know that you've opted out of direct marketing.

Funny that their agents still direct market though,
 
Gordon_R said:
As I suspected. The very definition of a 'spam' database:
Click to expand...

Not sure if it's a "spam" database per se, but here is one such database that contains owners details that a lot of the estate companies use,

#1 Data & CRM Tool for Estate Agents in South Africa | The Virtual Agent | Free Trial

Get reliable, date-stamped data on over 55 million individuals & companies to make quick, easy contact with sellers. Try The Virtual Agent for free, today!
www.thevirtualagent.co.za www.thevirtualagent.co.za

apparently collates data from various sources including the deeds office.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter