FNB fined R1 million for POPIA breach after sensitive customer information was exposed

First National Bank (FNB) faces a R1 million fine from the Information Regulator for violating the Protection of Personal Information Act (POPIA). The bank did not intentionally expose customers' personal information, but a security vulnerability in its app allowed unauthorized access to sensitive data. The flaw in the banking app granted some customers access to a feature meant for employees to assist with home loan applications, resulting in the exposure of ID numbers and, in nine instances, bank account numbers.

The Information Regulator found that FNB failed to address the security issue adequately after being alerted to the problem. While the bank restricted access for the affected individuals, it did not effectively resolve the broader security flaw, treating the separate incidents as distinct issues. The regulator identified significant shortcomings in FNB's identification, classification, and response to repeated security incidents that endangered the confidentiality of personal information.

This included an inadequate response to regulatory directives and a failure to strengthen security safeguards and organizational governance.

FNB is being fined for committing an offence under POPIA section 105, as the company should have known of the risk of such a contravention and the potential for substantial damage or distress to affected individuals. The regulator urges public and private organizations to review their compliance programs, enhance information-security measures, ensure Information Officers fulfill their statutory responsibilities, and promptly address regulatory directives.