The Government Communications and Information System has informed users of a personal information breach. (Image source: iStock)
The Government Communications and Information System (GCIS) has notified its users of a cyber security incident that may have impacted their personal information.
An agency in the Presidency, the GCIS leads government communications, coordinating public messaging and strategic communications across national, provincial and local government.
In an e-mail sent to applicants using its e-recruitment system, the agency says it identified suspicious activity targeting its web systems on 24 October.
Following the initial assessment, there are reasonable grounds to believe that personal information may have been accessed, or acquired by an unauthorised person, it states.
“In particular, the GCIS e-recruitment system was compromised, potentially exposing applicants’ personal information, including identity numbers, telephone numbers and e-mail addresses.”
See also
In line with applicable laws and regulatory requirements, including the Protection of Personal Information Act and the Cyber Crimes Act, the GCIS says it has taken immediate steps to isolate the affected system and prevent further unauthorised access or potential disclosure of personal information.
It further notes the incident has been reported to the relevant authorities, including the Information Regulator (InfoReg) and law enforcement agencies (South African Police Service as well as the State Security Agency).
“The matter is receiving priority attention, with investigations being undertaken to establish the circumstances surrounding the incident, the extent of the potential data exposure and any further risks that may arise.
“While investigations are ongoing, the potential exposure of personal information may increase the risk of identity-related fraud, phishing attempts, impersonation and other forms of misuse of personal information.”
The GCIS cautions that the notification “does not necessarily mean your personal information has been misused. However, given the nature of the incident, the GCIS considers it important to inform you of the potential risk so that you can take appropriate precautionary measures.
“The GCIS sincerely regrets this unfortunate incident and acknowledges the concern and inconvenience it may cause to affected applicants. We recognise the importance of protecting the personal information entrusted to us and take our responsibilities in this regard seriously.”
It also indicates that efforts are in place to “contain the incident, prevent further unauthorised access or disclosure, and strengthen the security of the affected systems”.
The cyber security incident comes amid high-profile data breaches reported in South Africa.
Data privacy law enforcer the InfoReg exclusively told ITWeb that from 1 January to 31 March, it received 788 data breach notifications from South African organisations.
Standard Bank and its insurance subsidiary Liberty Group both suffered data breaches earlier this year, raising fresh concerns about cyber security risks in the financial sector.
The big-four bank recently notified clients of unauthorised access to parts of its systems, exposing personal and business information, such as account numbers, company names and ID details, although it stressed that no funds were compromised and core banking systems remain secure.
South Africa’s insurance sector has faced a series of cyber security incidents involving insurers and third-party service providers.
Rand Mutual Assurance (RMA) recently confirmed it is investigating a possible cyber security breach after receiving an alert about unauthorised access to its systems.
The alleged RMA incident follows other cyber security concerns involving companies in the insurance sector, including MPI, Guardrisk and Hollard.
In the public sector, Statistics South Africa in March reported a cyber security breach affecting internal HR systems, raising concerns about government exposure.
In another incident, Polmed, the medical aid scheme for members of the South African Police Service, disclosed a potential data breach involving sensitive member information, further underscoring the vulnerability of healthcare and financial data.
Collectively, these incidents point to an escalating and sustained pattern of data breaches targeting critical institutions across the country.
