Nedbank warns clients after data breach – 1.7 million clients potentially affected

Nedbank says it has investigated a data security issue that occurred at the premises of a third-party service provider, namely Computer Facilities – a direct marketing company that issues SMS and email marketing information on behalf of Nedbank and a number of other companies.

A subset of the potentially compromised data at Computer Facilities included personal information (names, ID numbers, telephone numbers, physical and/or email addresses) of some Nedbank clients, the bank said.

“No Nedbank systems or client bank accounts have been compromised in any manner whatsoever or are at risk as a result of this data issue at Computer Facilities (Pty) Ltd,” it said.

Nedbank said it identified the data security issue at Computer Facilities (Pty) Ltd as part of its routine and ongoing monitoring procedures.

“Once we became aware of the issue, we engaged as a matter of urgency with the service provider and leading forensic experts to conduct an extensive investigation.

“We have moved swiftly to proactively secure and destroy all Nedbank client information held by Computer Facilities (Pty) Ltd. Information from Nedbank Retail relating to approximately 1.7 million clients were potentially affected of which 1.1 million are active clients.”

This incident is isolated to the third-party service provider’s systems. As a further precautionary measure, Computer Facilities Ltd’s systems have been disconnected from the internet until further notice, the bank said.

“We regret the incident that occurred at the third-party service provider, namely Computer Facilities (Pty) Ltd and the matter is receiving our urgent attention,” said Nedbank chief executive officer, Mike Brown.

“The safety and security of our clients’ information is a top priority. We take our responsibility to protect our client information seriously and our immediate focus has been on securing all Nedbank client data at Computer Facilities (Pty) Ltd, which we have done.

“In addition to this, we are communicating directly with affected clients. We are also taking the necessary actions in close cooperation with the relevant regulators and authorities.”

Nedbank Group chief information officer Fred Swanepoel said: “The third-party service provider namely Computer Facilities (Pty) Ltd did not have any links to our systems. Our team of IT specialists and external cyber security experts have been working continuously with them since we became aware of this matter.

“Clients’ bank accounts have not been compromised in any manner whatsoever and clients have not suffered any financial loss. Nedbank remains vigilant in its efforts to contain cyber crime.”

Nedbank said it has advised Computer Facilities of its obligation to notify any of their other customers potentially impacted by the incident.

“Clients’ bank accounts are not at risk and they do not need to take any further action other than continuing to be vigilant against attempts at fraud,” Nedbank said.

Read: Nedbank customers can now use Samsung Pay