The person behind the recent Absa data breach was a credit analyst at the bank who had access to risk modelling systems and sensitive client information.
The employee, who Absa said they trusted, leaked the client data to an external platform and then sold it to third parties.
This is feedback from Absa chief security officer Sandro Bucchianeri, who was speaking to ENCA about the data breach.
Bucchianeri first learned about the data breach on 27 October, after which they informed the Information Regulator about it.
Around a month after first being alerted to the data breach, Absa sent an email to affected clients warning them that their personal information had been shared with third parties.
He said the communication with customers was delayed to ensure they did not compromise the investigation, which was going through a court process at the time.
To date, Absa has not provided much detail about the number of clients affected and the person behind the leak, but Bucchianeri has now shed more light on the issue.
He said the Absa credit analyst sold private information about their retail banking clients to third parties.
While Bucchianeri could not divulge who these third parties were, he said they were from a “marketing type perspective who were looking for that type of information”.
“They may use the information to sell services or try to commit fraud on these accounts,” he said.
This employee has subsequently been suspended pending further information. Absa has also brought criminal charges against the employee, and these are playing out in the courts now.
Bucchianeri said the information which was leaked included bank account numbers, names and surnames, ID numbers, and contact details.
He added that the details of around 200,000 of their retail banking customers have been compromised.
Absa has now destroyed the leaked data and the external party devices have gone through an independent forensic review.
“We are in the process now to obtain the files for our own investigation,” said Bucchianeri.
He said Absa may also bring charges against the third parties who had access to the leaked data.
Following the data breach, Absa has implemented heightened monitoring on all the clients’ accounts who were leaked.