South Africa's Information Regulator has fined First National Bank R1 million after a flaw in its banking app let retail clients open other people's home loan applications. The regulator found the bank treated two separate reports of the flaw as isolated incidents rather than as a compromise of personal information.

What happened

According to the enforcement notice signed by regulator chair Pansy Tlakula on 21 October 2026, a system error classified some ordinary account holders as FNB employees. That gave them access, inside the banking app, to a staff function listing home loan applications in progress.

Clicking a name opened the full application: contact details, physical address, income and salary information, and in some cases account numbers. The regulator puts the exposure at 88 applicants, viewed by 696 unauthorised individuals, with nine applicants' account numbers among the data.

A customer reported the problem on 30 March 2022 and a second customer reported the same problem on 3 May 2022. FNB removed each individual's access but did not treat either report as a personal information compromise, and the regulator only became involved after a complaint in September 2022.

The notice finds an offence under section 105 of POPIA, on the basis that FNB reasonably ought to have known a contravention was likely and did not take reasonable steps to prevent it. It also questions the bank's collection of personal information from newspaper reports for screening purposes, and its retention of records without a stated legal basis.

Who is affected

• FNB home loan applicants whose files were visible to other customers before the flaw was closed.
• Any South African organisation running one application for both staff and customers, where access is decided by a user attribute that an administrator can mis-set.
• Companies that collect personal information from public sources for screening, which the notice also examined.

What to do now

Treat a second report of "I can see another customer's data" as a live incident, not a support ticket. The regulator's case turned on FNB failing to connect two identical reports into one flaw.

• Test the role and attribute mapping in every client-facing portal: create a test account, assign the wrong role to it, and confirm exactly what it can reach.
• Keep a written record of each report, when it was fixed, and what the fix covered, so a pattern is visible.
• Apply section 19 safeguards to client files, not just to databases: separate access, log reads of personal information, and review retention periods.
• When a misconfiguration exposes personal information, assess it under section 22 and notify the regulator where the risk is real.

What this means for South African businesses

The fine is modest by international standards, but the finding is the expensive part: the regulator judged FNB on what it should have known, not on what it intended. Most SMEs running a client portal carry the same weak point, a single application serving staff and customers with access decided by a field somebody set by hand.

A R1 million penalty is survivable for a bank and not for a forty-person firm, and the enforcement notice becomes part of the public record a client reads during due diligence. Identity numbers plus income data is also the exact combination that feeds sim-swap and loan fraud.

Source: TechCentral, reporting the Information Regulator enforcement notice dated 21 October 2026.

Also on the blog

• 319 Chrome extensions with 13.4 million installs hijacked search traffic
• Linux kernel CVE-2026-98432: 9.8 remote root flaw with no Ubuntu or RHEL patch

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.