- The Information Regulator is considering instituting a compliance assessment of the SABC’s handling of private customer information.
- This follows a cyber breach that allowed attackers to access account information without passwords.
- The SABC conducted its own investigation, revised its website and updated security protocols.
- For more financial news, go to News24 Business cover.
The Information Regulator is considering instituting a compliance assessment of the SABC’s handling of private customer information, saying the state broadcaster failed to inform it of a security breach of its TV licensing website.
The breach, which occurred a few months ago, allowed hackers to access TV license holders’ account details without their passwords.
The SABC itself confirmed the breach, which allowed hackers to access TV license account holders’ information this week, but said it had reviewed its TV license website and updated it with the latest security protocols. after being alerted to vulnerabilities on your website.
In response to questions from News24, the information regulator said late Wednesday that the SABC failed to report a security compromise as required by section 21 of the Personal Information Protection Act (POPIA).
Instead, the Information Regulator had been informed of the incident by a “data subject” who complained that his information had been compromised.
It said that when a “responsible party suffers a security compromise (breach) it should notify the regulator” and that since the Regulator had been made aware of it through a complaint, it was considering instituting a POPIA compliance assessment at the SABC under section 89 of the POPIA.
Mmoni Seapolelo, the interim executive of SABC’s marketing and corporate affairs group, told News24 early Tuesday in response to questions that the state broadcaster had launched its own investigation following an incident that occurred a few months ago. and determined that the vulnerability actually existed.
She said appropriate steps were taken immediately as the broadcaster took the security of customer information seriously. These included a “complete rewrite of the website, incorporating the latest security protocols”, while she also regularly tested and conducted additional security assessments to identify more gaps.
“At this stage, all identified vulnerabilities have been addressed and the TV license site is protected.”
Seapolelo said that as part of its cybersecurity checks, it had also designated an “ethical hacking company” to help it identify vulnerabilities on a regular basis to “further improve response to any new threats.”
Mybroadband.co.za first alerted the market to vulnerabilities that allowed hackers to access TV license account holder details in July 2022, and also reported this week that the Information Regulator was investigating the affair.
But Seapolelo told News24 that the SABC had not been notified of any investigation by the Information Regulator “regarding the vulnerability that led to a cyberattack on the TV licensing website.”
While the Information Regulator denied it was conducting a formal investigation, it said it was conducting a pre-investigation into a complaint filed by a “data subject” who “alleged that due to a security compromise [data breach] occurred in the SABC” your personal data was processed illegally.
The Information Regulator said that “on the records available to us” the SABC failed to report the security compromise as required by POPIA legislation, which is why it was considering compliance assessment of the state broadcaster.
