South Africa's Information Regulator has fined First National Bank R1 million after a permissions error in its banking app let ordinary customers read the personal records of home-loan applicants. FNB has 30 days to pay.
What happened
The enforcement notice, signed by regulator chairperson Pansy Tlakula, found FNB contravened sections 5, 8, 12, 14, 15, 19 and 105 of POPIA. An access-control mistake classified some ordinary account holders as employees, which handed them the view reserved for staff working home-loan applications.
Clicking a name in a list opened the whole record behind it: full names, identity numbers, contact details, physical addresses, income, salary information and account numbers. The regulator recorded the personal information of 88 data subjects exposed to 696 unauthorised individuals.
Two separate app users reported the problem, one in March and another in May, before FNB acknowledged the second complaint on 27 September. The finding turns on that gap: a known confidentiality vulnerability was not closed after two independent alerts.
Who is affected
- The 88 home-loan applicants whose names, identity numbers, income and salary details were readable by other customers.
- Nine of those applicants whose contact details and account numbers the regulator recorded as accessed by 696 individuals.
- Any South African business holding customer records behind a portal or app where a role check decides what a logged-in user can see.
What to do now
Test what a low-privilege account can actually see, not what the permission matrix says it should see. The FNB failure was not a break-in. It was a role assigned wrongly and left in place.
- List every role in your customer-facing systems, then log in as a real client or a basic staff user and check which records that account can reach.
- Put a second person on role and permission changes, and log them somewhere you can still read the history months later.
- Write a one-page POPIA breach path: who decides, who notifies the Information Regulator, who tells the data subjects, and within what time.
- Treat the first user report of exposed data as an incident. FNB had two before it responded.
What this means for South African businesses
The fine is small next to a bank's balance sheet, and that is the point: the regulator did not need a hack, a ransomware gang or a dumped database. It needed one badly configured permission and a slow response, both of which sit inside almost every small business running a client portal, an online application form or a shared CRM.
My read is that most SMEs are more exposed to this pattern than to anything on this week's CVE list, because it generates no alert and no indicators of compromise, only a customer who can see a record they should not. The seven POPIA sections cited matter more than the rand amount: a failure like this is a compliance problem, not just a technical one.
Source: MyBroadband - FNB fined R1 million for exposing private customer data.