Regulator probes ransomware attack on Cartrack

The Information Regulator is probing a data breach at vehicle tracking firm Cartrack, which fell victim to a ransomware attack in August. Cartrack's customer database, housing personal data such as contact details, bank account information and vehicle details, was reportedly accessed during the incident. The ransomware gang Dire Wolf listed Cartrack on its dark web leak site, claiming to have stolen 500 gigabytes of data from the company's servers.

Hangi Mbedzi, Acting Senior Manager for POPIA Compliance and Monitoring at the Information Regulator, confirmed that Cartrack had notified the regulator in accordance with Section 22. At this stage, it remains a preliminary notification, and the regulator is still reviewing its contents. Generally, all notifications must disclose the extent of the breach, including the number of affected data subjects and any other relevant details.

However, Mbedzi emphasized that they are still studying the notification and in contact with Cartrack regarding the matter.