South Africa: the MIP breach exposes customers of some forty insurers, and the ransom paid solved nothing

The cyberattack began in June, away from the spotlight. In September it became one of the most embarrassing data breaches of the year in South Africa. Hackers stole the personal information of customers of about 45 insurance companies from MIP Holdings, an IT provider that supplies policy administration and customer relationship software to insurers, medical schemes, lenders and pension fund administrators.

The affair brings together several lessons of modern cybersecurity: supplier risk, forgotten systems, reused passwords, and the illusions of paying a ransom. It concerns every company that entrusts its data to third parties.

Three weeks inside an end-of-life system

According to information published by TechCentral, the intruders got in using an employee’s reused credentials, then stayed about three weeks in a support platform that MIP was decommissioning. This detail is telling: systems being retired are often the least monitored, even though they still contain data.

About 400,000 records were taken. They include email addresses, phone numbers, policy numbers linked to ID numbers and, in a small number of cases, home addresses. For customers of the insurer Hollard, the published data includes names, ID numbers, email addresses and even children’s first names. MIP’s chief executive, Richard Firth, said almost all the affected clients were life insurers.

Ransom paid, data published anyway

MIP paid a substantial ransom, the amount of which has not been disclosed, after carrying out anti-money-laundering checks on the receiving accounts. The hackers had promised to destroy the data. On 7 September, however, the group published on its leak site data presented as belonging to Hollard customers. MIP found markers in this material linking it to the data stolen in June.

It is proof, once again, that a criminal’s promise is worthless. Paying a ransom offers no guarantee that the data will be destroyed, finances the next attacks, and can mark the victim as a target willing to pay. Hollard has in fact rejected claims that its own systems were hacked, pointing to the breach at MIP.

« Paying a ransom should not be understood as either establishing or settling compliance with the Protection of Personal Information Act. »

Information Regulator, South Africa’s data protection authority (paraphrased)

Who is responsible?

The regulators’ answer is clear: the insurers are. Under South Africa’s Protection of Personal Information Act (POPIA), the “responsible party” is the one that decides why and how data is processed. Here, that means the insurance companies. MIP is only an “operator”, which processes data on their behalf and must notify them without delay in the event of an incident.

The Information Regulator confirmed that MIP had reported the breach, as required by section 22 of the Act, and that three months later it was still trying to establish how many insurers and customers were affected. The Prudential Authority, part of the central bank, said it learned of the incident in mid-June from the insurers themselves. It does not require suppliers to report incidents to it directly, but insurers must report any material incident within 24 hours, under a joint standard adopted in 2024. For the Prudential Authority too, paying a ransom does not close an incident and does not relieve institutions of their responsibilities.

South Africa, a repeated target

South Africa is one of the African countries most targeted by cybercriminals, because its economy is highly digitised and its companies hold valuable data. In recent years, the country has suffered several major incidents: the 2021 ransomware attack on port and rail operator Transnet, which disrupted the ports, and data breaches at the credit bureaus Experian and TransUnion. Each time, millions of people had their information exposed.

POPIA, fully in force since 2021, provides for penalties: administrative fines of up to 10 million rand, and criminal prosecution in the most serious cases. But enforcement remains gradual, and the Information Regulator has limited resources given the number of incidents. The MIP affair, by its scale and the number of insurers involved, will test its ability to enforce the law.

Supplier risk

The MIP affair illustrates a risk companies often underestimate: that of the digital supply chain. An insurer can invest heavily in the security of its own systems, but if a supplier holding a copy of its data is less protected, that is the way the hackers will come in. A single compromised supplier, and dozens of client companies find themselves exposed.

Some of the companies named were keen to clarify their situation. Guardrisk, a subsidiary of the Momentum group, said it had no direct exposure to MIP, while acknowledging that one of its partners managing about 6,000 funeral insurance policies had been affected. This clarification shows how complex the outsourcing chains in insurance are: the insurer, its distribution partners, their IT providers.

For regulators, this complexity does not dilute responsibility: every insurer must know which suppliers hold its customers’ data, with what level of protection, and how it will be notified in the event of an incident. In practice, many companies discover the full extent of their outsourcing chain at the moment it breaks. The MIP affair should push the sector to map these dependencies and audit its critical suppliers, as it already does for its financial risks.

Lessons for every company

• Ban password reuse and require two-factor authentication, especially for employee and supplier access.
• Really retire end-of-life systems: erase the data, cut off access, monitor to the very end.
• Require suppliers to maintain a verified level of security, with rapid notification clauses in contracts.
• Prepare the incident response in advance, including the position on ransoms, so as not to decide in a panic.

For South African regulators, the investigation is only beginning. It could lead to penalties, but above all to stricter requirements for selecting and monitoring IT providers in the financial sector. For the hundreds of thousands of customers affected, the risk is immediate: their data may fuel well-documented scam attempts for months, all the more convincing because they will quote real policy numbers.