In March this year, Standard Bank told clients it had identified unauthorised access to select data. Three weeks later, it confirmed the data had been published online. The attackers claimed to have been inside the bank’s systems since 27 February and to have released 1.2 terabytes of data from Standard Bank and Liberty on their own timetable.
That sequence has become sadly familiar. This year alone, Pick n Pay, Standard Bank, Liberty, Stats SA, the Gauteng Provincial Government, Easy Equities, Hungry Lion, Bidvest Bank, CarTrack, and Toyota SA have all reported incidents.
The Information Regulator’s own numbers show the scale of the problem. It received 202 security compromise notifications in 2021/22, the first year its POPIA enforcement powers were operational; by 5 March 2026, that figure had reached 2,898 for the year, a fifteenfold increase, and the Regulator has called the rate of increase “very alarming”. This rapid increase is likely to intensify further given advances in AI.
Most companies treat cyber risk as an operational problem, and they are right to: patching, identity controls, backups, incident response retainers, and insurance are the first line of defence. But that plan answers only one question: how quickly can we get our systems back? It says nothing about what they tell staff, customers, the regulator, and the media, and when, a question usually answered for the first time mid-crisis, by exhausted people working from incomplete facts. Systems can be rebuilt in weeks, but confidence, once lost, takes years to rebuild.
The clearest local case study is the attack on the Government Pensions Administration Agency, which administers the GEPF. LockBit breached the agency’s systems in February 2024. The fund’s first public position was that no data had been compromised. LockBit then published a 668-gigabyte archive containing records of 168,000 people, and the GEPF admitted it had been misinformed. Systems stayed down until 21 June 2024, with benefit payments processed by hand, and this month the Minister of Finance dismissed the agency’s chief executive after a disciplinary hearing. The technical failure was serious, but the communications failure arguably made it worse. Once an organisation says nothing was taken and the attacker proves otherwise, every subsequent statement is discounted.
Modern ransomware groups often steal data first, then use publicity as leverage: leak sites, public deadlines, and direct contact with journalists. In the Standard Bank case, the attacker published its own account of events and accused the bank of abandoning its customers. A business that has not settled its position on ransom and disclosure before an attack is left reacting to a destructive campaign planned by a malign actor.
Internal communication is often the most neglected part of the response. Evidence shows that employees are often the way in for these malign actors: the Regulator lists negligence, weak passwords, and phishing among the recurring causes it assesses, and employees are also the first audience. Staff need to know what has happened, what they may say, where to refer queries, and how to spot the scams that follow.
For organisations, this means planning as much as possible in advance, including: decision rights on who signs off a statement at two in the morning and who speaks for the company; statements drafted for the likely scenarios; a mapping of every audience that must be kept informed, including the Information Regulator and affected data subjects; and a position on ransom agreed with legal counsel and insurers. It needs a discipline of saying only what is known and a plan agreed upon with the communications lead and legal counsel, not just the IT team.
South African companies, along with countless others around the world, will continue to be attacked, and some of those attacks will succeed, no matter how much they spend on defence. What customers and investors are often slower to forgive is a company that misled them or went silent while criminals told the story on its behalf.
Operational plans can protect an organisation’s systems, but a well-developed communications plan protects the trust that determines whether customers and investors are still there when the systems come back online. Companies that prepare for both will recover from an attack; those that prepare for only one may recover their systems yet still lose the business.
– Paul Boughey
CEO