A 36-year-old suspect was on Wednesday morning arrested by the Hawks’ Serious Commercial crime Investigation unit for the August 2020 data breach at consumer, business and credit information services agency Experian.
Experian said in a letter by its CEO last year that it had concluded an agreement for services with a company which had been impersonated and that as soon as this fraud was detected it was immediately investigated.
“It is important for us to clarify that Experian did not provide the fraudster with identity details. The fraudster provided Experian with 25 055 049 names, surnames and South African identity numbers which Experian verified.
“The data shared was limited to contact information including telephone, email and physical address and employment information which includes place of work, title, start date and work contact details.
“No personal consumer credit, financial or banking information was shared by Experian,” the letter reads.
The CEO further said at the time that the fraudster provided the agency with the names, addresses and registration dates of approximately 790 000 businesses.
“The business information that Experian shared back consisted of company registration details, general business information, company contact information and credit profile information.”
The CEO said last year that upon further investigation, files containing Experian data were found on the internet on a private file sharing site and were subsequently removed on 1 September 2020.
On Wednesday, Hawks spokesperson, Colonel Katlego Mogale said the suspect Experian had entered into a contract with “purported to be a certain Tebogo Mogashoa, a director of Talis Holdings”.
“The agreement gave the person access to the personal information held by the credit bureau of millions of people. The suspect then proceeded to download approximately 23 million personal data records and 727000 business records. The suspect then attempted to sell these records at about R4.2 million,” Mogale said.
Mogale added that the suspect is expected to appear in the Palm Ridge Magistrates’ court on Wednesday, 15 September 2021 on charges of fraud and the contravention of the Electronic Communications and Transactions Act.