The Hawks arrested a 36-year-old suspect in Gauteng on Wednesday (15 September) following an investigation into the data breach at Experian in August 2020.
South African Banking Risk Information Centre (SABRIC) announced that Experian, a consumer credit reporting company, had experienced a data breach, exposing the personal details of millions of consumers in South Africa.
Experian initially confirmed that it had experienced a breach of data which exposed some personal information of as many as 24 million South Africans, and 793,749 business entities, to a suspected fraudster.
It released a statement saying that its system had not been hacked, assuring customers that no financial data was compromised. However, personal information was leaked, including; consumer addresses, ID numbers, names, and occupations.
“Our investigations indicate that an individual in South Africa, purporting to represent a legitimate client, fraudulently requested services from Experian,” the company said.
“The services involved the release of information which is provided in the ordinary course of business or which is publicly available.”
“We can confirm that no consumer credit or consumer financial information was obtained. Our investigations do not indicate that any misappropriated data has been used for fraudulent purposes.”
It added that its investigations show that the suspect had intended to use the data to create marketing leads to offer insurance and credit-related services.
In a statement on Wednesday, the SAPS said that it is alleged that Experian entered into a contract with the suspect who purported to be a certain Tebogo Mogashoa, a director of Talis Holdings.
“The agreement gave the person access to the personal information held by the credit bureau of millions of people. The suspect then proceeded to download approximately 23 million personal data records and 727,000 business records.”
The suspect then attempted to sell these records at about R4.2 million, the police said.
“Consequent to his arrest, the suspect is expected to appear in the Palm Ridge Magistrates court today, 15 September 2021 on charges of fraud and the contravention of the Electronic Communications and Transactions Act.”