eNL Mutual Bank Exposes Customer Data in Major Security Lapse eNL Mutual Bank, South Africa’s first black-owned, women-led mutual bank, inadvertently exposed sensitive customer data due to a security misconfiguration. The breach was discovered on 16 April 2024 by Joel Cedras, an IT consultant working with GroundUp, who found that confidential information was publicly accessible via a URL (enlsystembo.co.za) and its corresponding IP address (102.131.62.58). The exposed data included full names, SA ID numbers, addresses, emails, phone numbers, bank account details, transaction histories, unencrypted card information, and database credentials all accessible without hacking or unauthorized access. The leak violated the Protection of Personal Information Act (POPIA), prompting GroundUp to report the incident to the Information Regulator (IR). Despite the IR’s R100-million-plus annual budget, the reporting process was cumbersome, requiring submission through an inefficient content management system. No response was received from the IR, nor from the Reserve Bank or Financial Sector Conduct Authority, beyond an automated acknowledgment. eNL Mutual acted swiftly upon notification, taking the exposed URL offline by Friday noon and assuming full responsibility. The bank confirmed the breach stemmed from a misconfiguration in a non-production environment and is treating it as a formal data leakage incident. It is notifying affected customers, engaging with regulators, and reinforcing security measures. The bank emphasized accountability, stating that it remains responsible for protecting customer data, whether managed internally or by third parties. eNL Mutual, which received its banking license in January 2024, operates exclusively online under founder Nthabeleng Likotsi. The incident highlights vulnerabilities in digital banking infrastructure and regulatory response gaps.