Cybersecurity incident update

Letter from the CEO

To our valued customers,

We are providing you with an update regarding the cybersecurity incident we previously communicated, and sharing guidance on how you can protect your personal information.

What Happened and Have There Been Any Developments?

As previously communicated, Cell C had detected unauthorised access to some parts of our IT environment.

Cell C is now aware that the data compromised in the recent cybersecurity incident has been unlawfully disclosed by RansomHouse, the threat actor claiming responsibility. This follows a previously reported incident involving unauthorised access to unstructured data in some parts of our IT environment.

We understand the seriousness of this development and deeply regret the distress or concern it may cause.

What Information Was Involved?

As reported previously, the varying types of customer data that was accessed include:

• Full names and contact details (email, phone numbers)
• ID numbers
• Banking details (if stored for billing purposes)
• Driver’s License Numbers
• Medical Records (if supplied for closure of accounts on death of a family member)
• Passport details

Given that this information has now been published by RansomHouse, we urge you to take steps to protect yourself from phishing, or potential fraud or identity theft.

How We Have Responded

• We continue to work with top cybersecurity experts to contain and mitigate the impact of the incident.
• We have notified the Information Regulator and other relevant authorities.
• We are further strengthening our cybersecurity infrastructure to prevent future incidents.

What You Can Do to Protect Yourself

We suggest the following to help protect yourself against phishing, or fraud or identity theft:

1. You Can Apply for Protective Registration (for free): SAFPS offers a free protective registration service for victims or potential victims of identity fraud. This means that additional verification measures will be taken when credit is applied for in your name.
   
   You can apply via the SAFPS website: www.safps.org.za in three different ways:
   • Apply online www.safps.org.za
   • Via Email by downloading an application form from www.safps.org.za/ and emailing it to protection@safps.org.za with the necessary supporting documents (you will need: certified copy of your ID or passport, proof of address, and the completed application form).
   • SAFPS Call-Back: You can also submit your details through the SAFPS website www.safps.org.za/, and one of their agents will contact you to begin the process.
   Please remember, SAFPS, Cell C, and legitimate financial institutions, will never ask you for your password, PIN, or OTP.

2. Monitor Your Financial Accounts: Check your bank statements and report any suspicious transactions. Check bank statements regularly and enable SMS or email notifications for outgoing payments. Look for any unauthorised transactions and report them immediately.
   Consider activating fraud alerts if your bank offers this or similar fraud protection services—e.g. enabling alerts on your account.

3. Stay Vigilant with Your Personal Information: Be cautious when sharing your ID, address, or bank information—especially in digital formats or with unfamiliar contacts.
   Fraudsters may attempt to impersonate Cell C or other trusted institutions. Do not share personal information over email or phone unless you are certain of the recipient’s legitimacy. Be cautious of unexpected messages or calls claiming to be from banks or service providers. Verify the sender's identity before responding or clicking on any links.
   Poor grammar or generic greetings (like "Dear Customer") in emails. Urgency or threats to suspend accounts or services. Links that don’t match Cell C’s official website URL (hover over the link to check, but do not click).

4. Monitor Your Credit Reports: Regularly check your credit reports with major credit bureaus (TransUnion, Experian, XDS, and Compuscan) for any unusual or unauthorised activity.

5. Update Your Passwords: If you use your the same password elsewhere, consider changing it to something strong and unique.

6. Enable Fraud Alerts: Contact your bank to activate fraud alerts on your account.

7. Install Anti-Virus and Anti-Malware Software: Use reputable solutions to detect and block malicious software. Keep the software updated and run regular scans.

8. Strengthen Device Security: Enable two-factor authentication (2FA) for all online accounts, especially financial services. Use a password manager to create and store strong, unique passwords for each account.

9. Keep operating systems and apps up to date to protect against vulnerabilities: For example, update your phone’s software when there is an update available – don’t ignore those notifications.

10. Report Suspicious Activity: If you suspect that you are a victim of identity fraud, report it immediately to SAFPS and open a case with the South African Police Service (SAPS).

Our Commitment to You

As part of our commitment to safeguarding the interests of our stakeholders and full transparency, Cell C has set up an Information Hub, www.worldofcellc.co.za/information-hub, where stakeholders can access tips on protecting themselves against cybercrime, support and actions to protect against fraudulent activity, as well as frequently asked questions on the cyber incident.

Need Help or More Info?

• Customer Care: 084 135
• Media Enquiries: media@cellc.co.za
• Information Hub: worldofcellc.co.za/information-hub

We thank you for your continued patience.

Yours sincerely,

Jorge Mendes

CEO, Cell C