The data that left MIP Holdings did not come from the software that runs insurance policies. It came from a help desk.
Here is a case study on how you can outsource your data, but not your responsibility for it. How the weak link is often a forgotten side system at a supplier. How when it breaks, customers may never be told.
Introducing MIP
MIP Holdings, also called MIP Group, is a South African technology company that sells to businesses, not the public. It supplies policy administration and customer-management software to insurers, medical schemes, lenders, pension administrators and outsourcing companies. The CEO is Richard Firth and Fergus McLoskey, its CIO. They both signed the company’s 23 June breach notification.
MIP’s customers are therefore the companies that hold people’s policies, loans and pensions. About 45 of them, just under half of MIP’s client base and almost all life insurers, were caught up in this breach. MIP is not regulated or supervised by the Prudential Authority, the Reserve Bank arm that oversees insurers. The authority collects information on insurers’ third-party arrangements each year to look for concentration risk, but it declined to validate MIP’s client numbers.
What Was Taken
MIP also ran a Jira support platform where clients logged problems. The company was in the middle of decommissioning that platform, according to Firth. Tickets on it were meant to hold obfuscated data. They did not. Staff had pasted in error messages, screenshots and reports, and the real records came with them. “That’s why we were taken aback that all of this data was actually sitting inside that platform,” Firth told TechCentral.
How They Got In
Intruders were inside from about 25 May, TechCentral reported, and MIP noticed in mid-June. ITWeb puts detection at 14 June. The attackers reached the platform using credentials an employee had reused on an unrelated service that had itself been breached. MIP says its core administration systems were not touched.
About 400,000 records were taken, TechCentral reported. Among them was a file of roughly 200,000 cellphone numbers compiled for an SMS campaign, and identity numbers pasted into tickets.
The attackers, a ransomware group called The Gentlemen, copied the data, encrypted some of it, and demanded money. MIP paid. Firth called the amount “substantial” and did not disclose it. In return, the group undertook to destroy the data.
What The Payment Bought
On 7 September, The Gentlemen listed Hollard on its leak site. MIP found markers linking that material to the June data. Hollard says it refused a ransom demand, according to TechCentral’s sources, and the group then published the details of Hollard funeral policyholders. Those details included their children’s names, identity numbers and email addresses.
Hollard says its own systems were not compromised and that the leak appears limited to individual funeral policyholders. A funeral policy is the kind of cover where dependants, including minors, are routinely listed. Hollard has notified affected customers and told them to watch for unsolicited messages and requests for personal or financial information.
An identity number does not change, and South African banks and retailers rely on it to open and verify accounts. “The payment bought nothing, however,” TechCentral wrote.
By early October the group had listed three more names: LegalWise, Samwumed and Edcon. Only LegalWise has confirmed involvement in the MIP breach. TechCentral could not verify that the group holds data from any of the three.
Guardrisk, part of Momentum Group, says it has no exposure to MIP. One of its binder holders, which administers about 6,000 funeral policies, was exposed and has notified the Information Regulator and its clients.
Who Has To Tell The Customer
The rules on who reports are not simple. Under the Protection of Personal Information Act (PoPIA), the duty to notify regulators and individuals rests with each insurer, as the “responsible party,” not with the supplier that holds the data. MIP reported to the Information Regulator on 16 June. As of 25 September, TechCentral reported, the regulator said that was the only notification it had received, and it was still working out how many insurers and policyholders were affected.
Insurers must also report material incidents to the Prudential Authority within 24 hours under Joint Standard 2 of 2024. The authority learned of the incident around mid-June through supervised institutions, TechCentral reported. Suppliers like MIP are not required to report to it directly. The authority would not say which insurers had reported, or when.
Both regulators have said what a payment does not do. The Information Regulator said a ransom payment should not be understood “in itself, as either establishing or resolving compliance with PoPIA.” The Prudential Authority said it “does not conclude an incident or relieve a supervised institution of its governance” responsibilities.
What Security Chiefs Say Worries Them
The incident lines up with what South Africa’s security leaders told ITWeb earlier this year. In its 2026 Brainstorm CISO Survey, 60 per cent named third-party risk as their top concern, ahead of unauthorised access at 51 per cent. Yet only 64 per cent had a playbook for it, against 92.5 per cent for data breaches and 83 per cent for ransomware. 75 per cent rated their machine-identity management at three or lower on a five-point scale. The survey ran from mid-May to mid-June, and its results are preliminary.
Jason Jordaan, Principal Forensic Scientist at DFIR Labs, told ITWeb that “third-party cyber security risk cannot simply be treated as somebody else’s problem.” Outsourcing, he said, does not remove an organisation’s duty to protect personal information.
Firth said MIP spoke publicly because companies that are breached tend to hide it, and that “silence helps no one.” The Information Regulator’s investigation is ongoing, according to Firth. It had not answered TechCentral’s questions on notification counts, scope, or ransom payments by the time of publication.
Click Here For The Original Source.
——————————————————–
