In September 2026 an attacker broke into RelyComply, a South African compliance platform that financial services firms use to verify client identities and monitor transactions. Three of our clients were RelyComply customers. Their own systems were untouched, yet between them about 380,000 people had personal information that may have been exposed, and each client had a legal duty to tell them. We helped them do that, and the notices went out within three to five business days.
What happened at RelyComply
This account uses only what has been published. At the time of writing the forensic investigation is still open, so details may change.
- About 2 September: the unauthorised access may have begun, according to RelyComply’s statement as relayed in notices published by its customers.
- 8 September: RelyComply became aware that someone had accessed part of the environment where it processes customer data.
- 9 September: a ransomware group calling itself Dire Wolf claimed the attack and said it had taken 200 GB of data. That claim is unverified.
- From mid-September: firms that use RelyComply began notifying their own clients.
RelyComply’s statement says the attacker exploited a zero-day flaw in a third-party application. A zero-day flaw is a weakness the software’s maker does not yet know about, so no fix exists on the day it is used. RelyComply reports that the access has stopped, the flaw is patched, and the affected environment has been rebuilt.
What POPIA required of our clients
POPIA calls the business that collects personal information the responsible party, and a supplier that handles it on the business’s behalf an operator. RelyComply was the operator. Our clients were the responsible parties, and the Act gives the duties to them.
- Section 21 requires the operator to tell the responsible party immediately when it has grounds to believe information was accessed.
- Section 22 requires the responsible party to notify the Information Regulator and every affected person, as soon as reasonably possible.
- The notice to each person must be in writing. It must describe the possible consequences, what the business has done, and what the person should do to protect themselves.
The role of the Information Regulator
The Regulator receives every breach notification, and since 1 April 2025 it accepts them only through its eServices portal. It can direct a business on how to notify people, and can order it to publicise a breach where publicity would protect the people affected. It can also investigate, and issue an enforcement notice ordering fixes. A fine normally follows only when such a notice is ignored.
What we did
Our part was the communication to the people affected. Each client made its own report to the Regulator.
- Three clients. Each had sent different records to RelyComply, so each needed its own notice.
- About 380,000 people to notify between them.
- Three channels: email, SMS and press releases. Section 22 lists email and publication in the news media among the accepted ways to notify.
- Three to five business days from each client learning of the breach to its notices going out.
What a notice like this has to do
- Say where the breach happened. Here it took place at a supplier, and the business’s own systems were unaffected.
- Name the information. “Some personal data” tells a reader nothing. A list of the exact categories tells them what to watch.
- Say what the business has done about it, such as stopping the flow of data to the supplier.
- Give people something to do. After a breach like this, the main risk is a convincing scam message that quotes real details.
What we would tell any business
- Keep a record of exactly which data each supplier holds. An accurate notice starts from that list.
- Draft the client notice before you need it, with blanks for the facts.
- Keep contact details current. A notice can only go by email or SMS to an address or number that still works.
- Decide in advance who signs the notice and who reports to the Regulator.
If one of your suppliers were breached tomorrow, could you tell your clients what was taken? Tell us what’s on fire