Rise in data breaches puts influencers and everyday users at risk

South Africans, particularly social media influencers and people with a strong online presence, are being warned to tighten their digital security as cybercriminals increasingly target personal information as data breaches continue to climb.

The warning comes as the Information Regulator has noted 2,374 security compromise notifications received during the 2024/25 financial year, almost 200 every month.

Between April and November 2025 alone, another 1,947 incidents were reported, representing a 40% increase.

The managing director of World Wide Industrial & Engineering Systems (WWISE), Muhammad Ali, said too many people still believe hacking “won’t happen to me”, until it does.

“Many people don’t realise this, but depending on who you are, some of your information is probably already on the dark web.

“Depending on the value you pose to cybercriminals, they may use that information against you. Social media influencers need to be especially careful because the more public your profile becomes, the bigger the target you become,” he said.

Ali said while companies are legally required under the Popia Act to notify customers when their data has been compromised, consumers also have a responsibility to act quickly once they receive those notifications.

“The first thing you need to do is establish whether you were actually affected. Don’t believe everything circulating on social media. Verify the information with the organisation involved and find out exactly what personal information may have been compromised.”

“Engage with your bank or the organisation responsible for the breach. They should explain your rights, the risks involved and the steps you need to take,” he said.

Often that may look like changing your passwords, replacing bank cards, updating PINs and enabling multi-factor authentication.

Ali said one of the biggest misconceptions among South Africans is believing cybercrime only affects large companies.

“The weakest link is people. Executives, employees and stakeholders often lack a proper understanding of cybersecurity threats such as phishing and spear-phishing,” he said.

“We also use multiple devices to access information, but many organisations lack proper identity management, firewalls and spyware protection. Many South Africans believe cybercrime won’t happen to them until it does,” he said.

The weakest link is people. Executives, employees and stakeholders often lack a proper understanding of cybersecurity threats such as phishing and spear-phishing.

—  Muhammad Ali

Ali said South Africa has become an attractive hunting ground for cybercriminals because many organisations continue treating cybersecurity as a compliance exercise rather than investing in meaningful protection.

“Cybercriminals also see South Africa as an attractive target because they perceive our infrastructure to be weaker and our penalties less severe than those in many developed countries. Many companies have privacy policies and compliance documents, but that doesn’t necessarily mean personal information is properly protected,” he said.

“They rely on policy templates generated through AI or generic documents simply to show stakeholders that they have a policy in place. A document doesn’t stop a hacker.”

According to the International Business Machines Corporation (IBM) 2025 cost of a data breach report, the average data breach now costs South African businesses R44.1m, substantially higher than Popia’s maximum administrative fine of R10m.

“When organisations have to choose between investing in growth or cybersecurity, many choose immediate revenue. They see cybersecurity as a cost instead of a business risk.

“The reality is that your personal information has value. The more visible you are online, the more careful you need to be. Cybersecurity is no longer just an IT issue; it’s something every South African needs to take seriously,” he said.

Sowetan