Experian South Africa Breach Exposes 1.28 M Personal Records Including Government IDs
What Happened — In August 2020 an unauthorized party accessed Experian’s South‑African credit‑bureau database, leaking 1,284,637 individual records. The exposed data set comprised email addresses, government‑issued identity numbers, full names, occupations, employers and phone numbers.
Why It Matters for Trust & Control Assurance —
- The incident is a textbook example of why continuous third‑party risk monitoring and documented data‑handling controls are essential for a defensible audit trail.
- Evidence of encryption, strict access‑control policies, and regular vendor‑assessment logs can demonstrate due diligence to regulators and auditors.
- A robust control‑assurance program helps organizations prove they have mitigated the same exposure risk before it materialises.
Who Is Affected — Credit bureaus and other financial‑service providers that rely on Experian’s data; the ~1.3 M South African consumers whose personal identifiers were disclosed.
Recommended Actions —
- Review all third‑party contracts for explicit encryption‑at‑rest and in‑transit requirements, and verify that Experian (or any data‑provider) meets them.
- Deploy continuous monitoring of vendor access logs and retain audit‑ready evidence of who accessed what, when, and why.
- Conduct a gap analysis against the “Data Protection & Access Control” control objective and remediate any deficiencies.
Technical Notes — The breach involved the exposure of email addresses, government‑issued ID numbers, names, occupations, employers and phone numbers. No malware, CVE, or specific exploit was disclosed. Source: Have I Been Pwned – Experian South Africa breach