Less than a year after South Africa experienced its largest data leak, the country is again suffering yet another data leak, as 934,000 of its citizens' records were leaked on the internet.
The data includes, among others, people's full names, email addresses, national identity numbers (ID numbers), as well as plain-text passwords for traffic fines related online system.
Troy Hunt, an Australian Security consultant and founder of haveibeenpwned, has been working with an anonymous source to provide information to iAfrikan.
“I have a new leak which might be worthwhile, the database leak contains 1 million records of personal information of South African citizens. Including Identity numbers, cell phone numbers, email addresses, and passwords. I am aware of the website this was leaked from,” said the source.
They added that the database in which the personal records were discovered, was located on a public web server that belongs to a company that handles electronic traffic fine payments in South Africa.
iAfrikan was able to view the publicly available database.
And just like the 2017 data leak, it was said that the possible scenario was the carelessness of handling citizens data. This can be seen as the directory listing/browsing were enabled on the directory where the "backups" were saved.
"This is yet another reminder of how far our data can spread without our knowledge. In this case, in particular, the presence of plain text passwords poses a serious risk because inevitably, those passwords will unlock many of the other accounts victims of the breach use. This one incident has likely already led to multiple other breaches of online accounts due to that reuse," said Hunt to iAfrikan.
The news about the leak came when South Africa’s Information Regulator is under pressure to act or share feedback on recent data leaks involving South African citizens data, including those that were affected by the Facebook - Cambridge Analytica scandal.
