A Credit Bureau, an Estate Agency, and a Web of Cybercrime Intrigue
One of the country’s most prestigious real estate companies obtaining leaked customer information from the Experian data breach reads like a work of fiction. Yet this bizarre possibility is playing out in the media right now, with all parties involved scrambling to limit the damage to their reputations.
Real Estate Agency Pam Golding has been associated with luxury real estate in South Africa for decades, with the company successfully crafting a brand centred around exclusivity and the highest standards.
However, a recent data incident concerning the company’s contact database is shining an uncomfortable spotlight on this well-known estate agent’s network and its potentially bizarre connection to last year’s Experian data leak.
Did property giant Pam Golding obtain information from a data leak?
One of SA’s best known companies’ handling of sensitive information was publicly brought into question recently when a cybersecurity researcher noticed a strange pattern of data ownership regarding their own email address.
The researcher, who is extremely careful when it comes to online privacy, used a catch-all email address with various aliases when entering their information online – a practice that’s worth emulating in your own personal and business dealings.
So far, there’s nothing surprising in the story – until you find out what happened next: the individual discovered that their email address had been compromised after Pam Golding revealed that a large chunk of its database had been subject to unauthorised access earlier this year, apparently due to stolen credentials.
- The perplexing aspect of this incident was that the individual had never provided Pam Golding with the alias email address they usually use online.
- On further inspection, they discovered that the realtor had also sent them a direct marketing email several months prior, once again to the same address that had never been voluntarily provided. However, the same address had been part of the Experian data breach that affected millions of customers across the country.
The awkward question that arises from all of this is: how did Pam Golding come to possess this email address, and how many other people’s personal information does the company currently hold without their knowledge?
As cybersecurity experts, we can think of two possible explanations for what happened:
- Pam Golding somehow obtained leaked personal information from the Experian data breach last year, or
- Experian provided them with this information through official – if not legitimate – means.
As a reputable and large business, which is very much a household name across South Africa and even in neighbouring markets like Mauritius, it’s hard to imagine Pam Golding skimming the dark net for opportunities to buy leaked Experian data.
The far more likely explanation is that Experian has been sharing the personal details of credit customers from its database with third parties for a fee. As such, it’s more plausible that Experian, and not Pam Golding, has serious questions to answer regarding the protection of personal data privacy.
Are credit bureaus doing a side trade in confidential client information?
The allegation that credit bureaus sometimes sell confidential information to other businesses may be disturbing but it’s not new. Dominic White, one of the country’s foremost cybersecurity experts, has been speculating for years that this is the case.
Without accusing either organisation of wrongdoing, it’s not a far stretch to assume that something of this nature might have happened in a case like this.
Pam Golding declines to comment, citing POPI regulations
The media has reacted with an understandable measure of alarm in the wake of the Pam Golding and Experian accusations, and to date the real estate group has been tight-lipped about the details of the incident. It must be mentioned however, that Pam Golding took immediate steps to contain the breach, acting swiftly to secure their systems and removing all unauthorised access.
In an ironic twist, Pam Golding maintains that they’re unable to comment on any aspect of their clients’ data in order to remain in compliance with the Protection of Personal Information Act.
This, despite the fact that obtaining sensitive customer information from a third party without the owner’s permission could likely constitute a breach of the Act itself.
Whatever the outcome of this embarrassing incident may be, the lesson for all businesses is clear: consumers are no longer willing to tolerate the mishandling of their personal information, and when companies are suspected of acting irregularly, the incident is likely to become highly publicised and do damage to their reputation.
Protect your data and your business reputation today
If this incident has given you cause for thought as to the best practices to follow in your own business when handling client information, we’d like to support you in creating a comprehensive data security approach that protects not only your information, but that of your clients.
Our range of secure cloud storage packages, particularly our Total Data Protection offering, can help ensure that all customer information is kept safe and help you comply fully with POPIA. Click the button below to learn more.
