South African Companies Hit by Third-Party Cybersecurity Breach Affecting Customer Data South African telecom operator Cell C, investment platform EasyEquities, and Bidvest Bank have notified customers of a cybersecurity incident at an unnamed third-party service provider, potentially exposing sensitive personal information. Cell C alerted customers of its subsidiary, Cell C Fiber, on September 9, 2026, after the service provider detected a breach involving compromised access credentials. The exposed data includes customer names, email addresses, mobile numbers, and account numbers, though the company stated that no financial or password details were affected. Cell C has activated its incident response protocols and is collaborating with cybersecurity specialists to contain the breach and investigate further. EasyEquities confirmed that a third-party vendor responsible for regulatory verification checks may have compromised customer data. While the company’s trading and investing systems remain secure, it is working with the provider to assess the extent of the exposure. No evidence suggests that Purple Group Limited (EasyEquities’ parent company) or client accounts were directly impacted. Bidvest Bank also disclosed a breach at a third-party service provider but did not specify the exposed data or the vendor involved. The bank confirmed that its data was stored in the affected environment and is treating it as potentially compromised. An independent forensic investigation is underway to determine the scope of the breach. This incident follows a March 2026 data leak at Standard Bank, where client and company-related data was published online after a February cyberattack. Additionally, in 2025, both Cell C and MTN suffered breaches that exposed customer information, highlighting ongoing cybersecurity challenges in South Africa’s financial and telecom sectors.

Third-Party Data Breach Exposes Personal Information of EasyEquities and Satrix Users EasyEquities and Satrix have disclosed a potential compromise of personal information stemming from a third-party service provider, RelyComply, which handles regulatory verification checks for both platforms. The breach did not affect trading systems, account security, or users’ ability to invest, according to statements from the companies. EasyEquities, which operates the SatrixNOW platform on behalf of Satrix, confirmed that its internal investigation found no evidence of a direct compromise to its systems or those of its parent company, Purple Group Limited. The third-party provider has launched a forensic investigation to determine the scope and nature of the incident, with final findings still pending. Both companies have pledged to share further updates if necessary. With nearly 2.9 million users 1.24 million of whom were active as of February 2026 EasyEquities serves as a key investment platform, partly owned by Sanlam. While the exact number of affected users remains undisclosed, the companies have advised users to remain vigilant against phishing attempts and unsolicited requests for personal information. This incident follows a similar breach at Standard Bank earlier this year, where unauthorized access to internal administrative systems exposed select customer data. Under South Africa’s Protection of Personal Information Act (Popia), such breaches may require reporting to the Information Regulator, though neither EasyEquities nor Satrix has confirmed whether this step has been taken.