Dear valued Customer,

NOTIFICATION OF A SECURITY COMPROMISE IN TERMS OF SECTION 22 OF THE PROTECTION OF PERSONAL INFORMATION ACT, 4 OF 2013

We hope this message finds you well. We’re writing to inform you about an recent incident that occurred; one that requires your attention but without causing undue concern.

Through engaging with us (Hero Telecoms (Pty) Ltd) (“Herotel”/us/our/we”) as your internet service provider, you entrusted us with some personal information as per the Protection of Personal Information Act No. 4 of 2013 (referred to as “POPIA”). As part of our service, we obtained your consent through the Master Service Terms, to share this information with third party processing agents, such as Netcash (Pty) Ltd (“Netcash”).

Netcash (the Operator in terms of POPIA) plays an important role as a 3rd party payment service provider for Herotel (the Responsible Party), managing debit order processing on our behalf.

Even though we have strict security measures in place, we have reason to believe there was a security incident at Netcash, potentially involving personal information being accessed by an unauthorised third party, and as such we want to provide you with the available information so you can take necessary precautions.

Here are the key details:

  1. On August 21, 2023, a Netcash employee, handling a debit order query with us, accidentally sent a debit order batch file to Pienaar Partners t/a Mellin I Style Optometrists (“Pienaar Partners”), thinking that she was dealing with us.
  2. The mistake was recognized by the employee the next day and immediately reported to Netcash’s Management, who contacted Pienaar Partners on the same day, requesting the immediate destruction of the email and its attachment.
  3. Pienaar Partners confirmed on August 23, 2023, that the email was unopened, and they had deleted it, successfully containing the situation.
  4. The incident resulted from an unfortunate human error on the part of Netcash’s employee.
  5. The unauthorized party who received the email with the debit order batch file, and who we are obliged to notify you of in terms of POPI, is identified as Ms. Brenda McPherson, a bookkeeper at Pienaar Partners.

The personal information that may have been accessed includes:

  • One debit order batch report in CSV format.
  • The number of Data subjects affected are 1,007 individuals and 45 legal entities.
  • Banking account numbers, bank branch numbers, debit order amounts, and account holder names.

To address this situation and protect your personal information further, Netcash has taken the following actions:

  1. Confirmed destruction of the email containing your information with Pienaar Partners.
  2. Gathered information relating to the incident, with the purpose of pursuing appropriate disciplinary measures regarding the involved employee.
  3. Instituted a secure document sharing policy and training, including password protection.
  4. Scheduled additional POPIA training for staff to prevent future breaches.

While there’s a possibility that this incident could lead to the sale of your data or attempts at fraud, we want to reassure you that your security is a priority for us. To further mitigate potential risks, we recommend the following steps:

  1. Register your Names and ID numbers with the South African Fraud Prevention Service at 011 867 2234 to be added to their database. This prevents unauthorized credit applications in your name without the provided SAFPS letter by yourself.
  2. Stay vigilant and promptly report any suspicious activity on your bank account to your bank or relevant authorities.
  3. Change your online bank account password(s) for the affected accounts, as a precaution.

Should you have any questions or concerns about this incident, please reach out to the writer at [email protected] or contact our Legal Officer, Reitz Krige, at 021 300 0142.

Your trust in Herotel is of utmost importance to us, and we are committed to ensuring your data remains secure. We apologize for any inconvenience this may have caused and thank you for your continued support.

Sincerely,

Imel Rautenbach
Information Officer