Experian South Africa data breach: what happened and what to do

What happened

Have I Been Pwned (HIBP) dates the Experian South Africa breach to 19 August 2020 and added it to its database on 1 September 2020, with 1,284,637 accounts. Those are the accounts that HIBP could load, mainly entries with an email address. Experian's own statements put the scale much higher: it said personal information of as many as 24 million South Africans and 793,749 business entities was exposed. Its chief executive later cited 23.4 million individuals.

Experian said its systems were not hacked. An individual in South Africa, claiming to represent a legitimate client, had fraudulently requested its services and was given the data. Experian said the person's hardware was impounded and the data secured and deleted, and it went to court. In early September 2020, South Africa's Information Regulator said that data had been posted on the dark web, citing a whistleblower. That conflicted with Experian's earlier statement that the data had not been used.

What was exposed

HIBP lists email addresses, employers, government issued IDs, names, occupations and phone numbers. Press coverage describes ID numbers, addresses and contact details. Experian said no financial data was compromised, although some business bank account numbers were obtained.

South African ID numbers are worth explaining. They are 13 digits and encode the holder's date of birth, along with a gender indicator and a citizenship marker. That means anyone with the number also has a date of birth, and the number is widely used to open accounts, sign up for services and verify identity. You can't change it.

What it lets criminals do

An ID number with a name, a phone number and an employer is enough to attempt identity theft: applying for credit, taking over a mobile contract or answering security questions at a bank or call centre. Employer and occupation details help scammers write messages that sound like they come from work, such as a fake HR or payroll message, and they help them pick targets with higher incomes.

The breach is from 2020, but ID numbers never expire. A person's number is just as useful to a criminal today as it was then, which is why the checking steps below still matter.

Experian's response

Experian South Africa said it was working with the authorities and the Information Regulator and pursued criminal charges against the person responsible. It said it would help affected people and recommended standard precautions. The company has described the incident as a case of fraud by a client, not a failure of its network.

Are you affected?

If you have ever applied for credit, a loan, a contract or a store account in South Africa, a credit bureau holds your record, and you could be among the millions in the wider incident whether or not your email address is in HIBP's list. Check your email address on HIBP anyway, and treat your ID number as exposed if you are unsure.