Absa, 2020: the data leak that came from inside the bank

In November 2020, Absa — one of South Africa's largest banks — notified customers of a data leak with an uncomfortable origin. There was no ransomware, no external intrusion and no phishing email. The bank's own investigation pointed to one of its own employees.

What happened

Absa disclosed that an employee had unlawfully made the personal information of a portion of its customers available to a small number of external parties. The individual was reported to be a credit analyst — someone whose legitimate role included access to customer records. The data involved was reported to include identity numbers, contact details, physical addresses and account numbers. Absa initially described the affected group as a small portion of its South African retail customer base; subsequent reporting in 2021 indicated the investigation had identified more affected customers than first communicated, and the bank updated its notifications accordingly.

The bank's response was unusually forceful. Absa said it had obtained High Court orders enabling search-and-seizure operations at premises linked to the recipients of the data, secured and deleted the data on recovered devices, laid criminal charges against the employee concerned, and dismissed them. It notified the Information Regulator, warned affected customers, and monitored accounts for signs of fraud, stating that customers would be protected against loss arising from the incident.

How the attack worked

This was insider misuse of authorised access. The employee did not need to defeat a single technical control: the records were available to them because their job required it. What failed was the layer of controls that is supposed to constrain authorised users — monitoring of unusual access patterns, limits on bulk retrieval, and the deterrent effect of knowing that access is watched.

Insider incidents of this kind sit at the far end of the human-risk spectrum from phishing, but they are part of the same discipline. An organisation's risk is not only that employees will be deceived; it is also, more rarely, that they will be dishonest — or recruited, pressured or bribed by outsiders who understand that buying an insider is cheaper than breaching a bank perimeter.

The impact

For affected customers, exposed identity and account data meant a durable elevation in fraud and social-engineering risk — data of that kind fuels convincing vishing and phishing long after the incident closes. For Absa, the costs included the investigation and litigation, regulatory engagement under POPIA (which had come into force months earlier), customer notification and monitoring, and the reputational weight of explaining that the breach was internal. The case became one of South Africa's most cited insider-threat precedents, demonstrating both the damage a single trusted person can do and the value of a rapid, legally muscular response.

Lessons for African organisations

Monitor authorised access, not just intrusions. Analytics on who accesses what, in what volumes and patterns, is the primary detective control against insider misuse — and its known presence is a deterrent.
Apply least privilege and bulk-access friction. Roles rarely need unlimited record-by-record reach. Caps, approvals for bulk exports and watermarking narrow what one person can leak.
Prepare the legal playbook. Absa's court orders and seizures limited onward spread of the data. Knowing in advance how to obtain urgent relief is part of incident readiness.
Update disclosures as facts evolve. The affected population grew as the investigation matured. Committing to transparent, corrected communication preserves trust better than a single premature statement.
Build an ethics and reporting culture. Colleagues are often best placed to notice misconduct early. Safe, trusted whistleblowing channels shorten insider incidents.

Sources

Absa public statements and customer notifications, November 2020
Follow-up reporting on the widened scope of the leak, 2021
ITWeb, MyBroadband and Moneyweb coverage, 2020–2021
Reporting on engagement with the Information Regulator (South Africa), 2020–2021

Trust is a control that needs verification — the free Human Risk Maturity Assessment shows in four minutes how well your organisation manages both the deceived and the dishonest.