The Government Communications and Information System has told job applicants that its e-recruitment system was compromised, and that identity numbers, telephone numbers and email addresses may have been taken. The agency says it picked up suspicious activity against its web systems on 24 October.
What happened
GCIS, the communications agency that sits inside the Presidency, emailed users of its recruitment portal after an initial assessment gave it reasonable grounds to believe personal information had been accessed or acquired by an unauthorised person. It says the affected system was isolated and the incident reported to the Information Regulator, the SAPS and the State Security Agency.
The agency has not said how many applicants are affected, how the access was obtained, or how long the system was exposed. Its notice states that the investigation is still working out the extent of the exposure.
Who is affected
- Anyone who applied for a post through the GCIS e-recruitment system and submitted an ID number, phone number or email address.
- Recruiters and hiring teams in any organisation that holds the same fields in its own applicant system.
What to do now
Treat any message that quotes your ID number and asks you to confirm details as hostile until it is proven otherwise.
- Tell applicants that a government agency will not ask for ID numbers, passwords or one-time codes by email or SMS.
- Watch for phishing that reuses real application details, and report it to the agency and to SAPS.
- If your own recruitment or HR portal holds the same data, confirm whether it is internet-facing, patched, and logging access.
What this means for South African businesses
Every South African organisation with a public-facing form is holding the same pairing of ID numbers and contact details, and section 19 of POPIA expects safeguards that match that risk. The realistic danger here is not the leak itself but the follow-up wave: an ID number plus an email address is enough to make a fake application message convincing, and small HR teams are the least prepared to spot it. Treat a recruitment portal as a customer-facing system, not as a form bolted onto the marketing site.
Source: ITWeb - GCIS warns of information breach.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.