Hollard Denies Its Systems Were Hacked After MIP Confirms Third-Party Breach
Summary
Hollard says it found no evidence its systems were compromised. MIP Holdings confirmed a June cyber incident affecting personal information linked to customers of about 45 South African insurers; the investigation is ongoing.
Key points
- MIP Holdings says it detected a cyber extortion attack on its third-party Jira platform on 14 June.
- MIP says attackers used credentials obtained from Jira to access the platform and certain FTP/SFTP sites; its core systems and client policy-administration databases were not compromised.
- The affected Jira environment contained personal information about employees, client users, and members or customers. MIP is still determining the precise scope and whether information was downloaded, copied, misused, or disclosed.
- MIP identified the attacker as the ransomware group The Gentlemen and says it received undertakings that accessed data would be deleted and not published or misused.
- Hollard says forensic work has found no evidence of compromise in its environment and attributes the threat actor's claim to the MIP incident.
- LegalWise, LEZA, and the National Fund for Municipal Workers also reported responses to the incident; the fund warned members that personal information may have been accessed and advised caution against phishing and fraud.
- MIP notified the Information Regulator and relevant financial authorities. An expert cited in the article says the incident highlights risks from third-party providers holding sensitive information for multiple organizations.
Article Details
- Victim Organization
- MIP Holdings
- Incident Type
- Cyber extortion attack targeting MIP Holdings' third-party Jira environment, with attackers accessing Jira and certain FTP/SFTP sites using credentials obtained from the platform.
- Incident Date
- 2026-06-14
- Disclosure Date
- 2026-06-23
- Data Types Exposed
- Personal information relating to employees, clients' users, and members/customers
- Information visible in screenshots and task attachments
- Access credentials in some cases
- Affected Records
- Personal information linked to customers of about 45 South African insurance companies; exact scope is still being determined.
- Operational Impact
- MIP reported that its core systems and client policy-administration databases were not compromised. The affected Jira environment and certain FTP/SFTP sites were accessed. The article does not report service disruption.
- Ransom Or Extortion
- MIP identified The Gentlemen as the attacker and described the incident as a cyber extortion attack. It said it had received undertakings that unlawfully accessed data had been deleted and would not be published or misused; no ransom payment or demand specific to this incident is reported.
- Claim Status
- confirmed