Your business might have a strong firewall, sensible passwords and well-trained staff, and still have its data exposed. That is the warning behind a run of South African incidents over the past few weeks, where attackers got in through a trusted outside supplier rather than through the company’s own front door.
What happened
In September, EasyEquities and Bidvest Bank both notified customers of cybersecurity incidents involving a third-party service provider, and Cell C Fibre warned customers about a related third-party incident, IT-Online reported on 9 October. EasyEquities said the provider handled client-verification checks and that there was no evidence its own systems or trading accounts had been compromised.
These are not isolated cases. In an article published on ITWeb on 15 October, Armata Cyber Security listed several other 2026 incidents linked to third parties or attacks on suppliers, including Sanlam, Profmed and the distributor Rectron. It also pointed to SecurityScorecard research finding that 35.5% of data breaches originated from third-party compromises.
Meanwhile, Sophos’ State of Ransomware in South Africa 2026, quoted by IT-Online on 20 October, found that for 47% of South African organisations hit by ransomware in 2025, the attack succeeded because of inadequate protection.
What it means for South African businesses
You don’t have to be a bank to be affected. Every SME relies on outside services: email and cloud apps, accounting software, payment providers, IT contractors and internet providers. Each one is a possible way in. Under POPIA, your business is still responsible for the personal information it collects, even when a supplier is the one holding it.
A few practical steps make a real difference:
- Know which suppliers can access your systems and data, and remove access that is no longer needed.
- Turn on multi-factor authentication everywhere, especially for email and remote access.
- Keep backups that are separate from your main systems, and test that you can restore them.
- Work with fewer, trusted providers who take security seriously and can tell you clearly what they protect.
How Collabolink can help
We help small and medium businesses close these gaps without unnecessary complexity. Our IT Security service covers protection against phishing, ransomware and data loss, while Onsite & Offsite Backup and Disaster Recovery for Servers make sure you can recover if something goes wrong. We can also secure your Microsoft 365 accounts and design segmented office networks that keep guest, payment and staff traffic apart. With Outsourced IT, you get one accountable team instead of a long list of suppliers.
Talk to us
Not sure how exposed your business is? Call us on 063 695 4358 or email admin@collabolink.co.za for a no-obligation chat about your security and backups.
Sources: IT-Online, “Cybersecurity perimeter extends beyond the organisation’s walls” (9 Oct 2026); ITWeb / Armata Cyber Security, “Third-party suppliers have become the new enterprise vulnerability” (15 Oct 2026); IT-Online / Itec SA, “Ransomware has moved on. Has your security strategy kept up?” (20 Oct 2026).