Nedbank announced that it has discovered a security breach at Computer Services Ltd, a third-party service provider which issues SMS and email marketing on behalf of the bank.
“A subset of the potentially compromised data at Computer Facilities included personal information (names, ID numbers, telephone numbers, physical and/or email addresses) of some Nedbank clients,” the bank said.
The security breach was discovered during a routine monitoring procedure, and once the bank became aware of it, it immediately conducted an extensive investigation.
1.7 million clients were affected by this security issue, with 1.1 million of those clients being active. The following information was exposed:
- ID numbers
- Telephone numbers
- Physical addresses
- Email addresses
“We have moved swiftly to proactively secure and destroy all Nedbank client information held by Computer Facilities (Pty) Ltd. Information from Nedbank Retail relating to approximately 1.7 million clients were potentially affected of which 1.1 million are active clients,” said Nedbank.
Communicating with clients
Nedbank said the incident was isolated to Computer Facilities’ systems, which it has disconnected from the Internet until further notice as a precautionary measure.
“We regret the incident that occurred at the third-party service provider, namely Computer Facilities (Pty) Ltd and the matter is receiving our urgent attention. The safety and security of our clients’ information is a top priority,” said Nedbank chief executive Mike Brown.
“We take our responsibility to protect our client information seriously and our immediate focus has been on securing all Nedbank client data at Computer Facilities (Pty) Ltd, which we have done.”
“In addition to this, we are communicating directly with affected clients. We are also taking the necessary actions in close cooperation with the relevant regulators and authorities,” he said.
Nedbank assured users that Computer Facilities did not have any links to its systems.
“Our team of IT specialists and external cybersecurity experts have been working continuously with them since we became aware of this matter,” said Nedbank chief information officer Fred Swanepoel.
“Clients’ bank accounts have not been compromised in any manner whatsoever and clients have not suffered any financial loss.”
Nedbank said it remains vigilant against cybercrime and has advised Computer Facilities of its obligation to notify its other customers of the incident.
Clients’ bank accounts are not at risk and they do not need to take any further action other than continuing to be vigilant against attempts at fraud, the bank said.