BUSINESS NEWS - South Africa’s funeral insurance sector faces growing questions about data security and control following a cyber incident that exposed customer information linked to 45 insurance-sector clients.

The incident has highlighted the risks associated with third-party software providers and the challenges facing funeral parlours, administrators and binder holders that rely on systems they may not own or control.

Chris Ogden, CEO of RubiBlue, says businesses need greater visibility over where policyholder information is stored, who can access it and how quickly it can be retrieved if something goes wrong.

Data breach exposes vulnerabilities

South Africa’s life insurers issued 6.2 million new funeral policies in 2025, accounting for more than half of the 10.8 million new individual recurring-premium risk policies sold that year, according to industry figures. Many of these policies are sold through funeral parlours, administrators and binder holders that build relationships with families and manage their policies on behalf of insurers.

However, a cyber incident discovered in June 2026 exposed approximately 400 000 customer records held on a support platform used by 45 South African insurance-sector clients. The compromised information included policy numbers linked to identity numbers. Among those affected was a binder holder administering about 6 000 funeral policies.

The incident raised questions about how personal information is protected across the insurance value chain, particularly when multiple businesses depend on the same technology provider.

Under the Protection of Personal Information Act (Popia), the insurer remains responsible for meeting its obligations as the responsible party, while the Prudential Authority has emphasised that insurers must address incidents originating at service providers. Material incidents must be reported within 24 hours.

According to Ogden, the incident also highlights concentration risk: the potential impact when a single supplier provides services to a significant portion of an industry.

Risks extend beyond insurers

Concentration risk is generally assessed at insurer level, with the Prudential Authority collecting information on material outsourcing arrangements to identify potential vulnerabilities.

However, this oversight does not necessarily give individual funeral parlours a clear picture of the security arrangements protecting their customers’ information.

Many parlours, administrators and binder holders use systems supplied by the insurers or administrators whose policies they sell. They may have limited insight into how information is stored, accessed or handled by support staff, or where copies of customer records are kept.

This creates a potential gap between responsibility for protecting policyholder information and the practical ability to monitor and control the systems holding it.

When a breach occurs, information may also have to pass through several parties before reaching the affected business or policyholder. Funeral parlours can find themselves fielding concerned customers’ questions without having been informed of an incident affecting their records.

Ogden argues that businesses should be able to access and retrieve their complete policy records independently, allowing them to respond to security incidents, recover operations or change providers when necessary.

Four steps to reduce exposure

Businesses can take several practical steps to improve oversight of their data and reduce their exposure to third-party risks.

1. Map where customer information is stored

Companies should look beyond their core administration systems and identify every platform that holds personal information. Support tools, testing environments, reporting extracts and bulk SMS campaign files can all contain sensitive customer details.

The 2026 incident demonstrated that a breach can originate from a support platform rather than the main policy administration system.

2. Test data recovery and portability

Businesses should establish whether they can obtain a complete, usable copy of their policy records within days. This should be tested as part of disaster recovery planning rather than as an administrative formality.

Having access to records can help a business recover from an incident or move to another provider without losing control of its policy book.

3. Clarify incident notification responsibilities

Contracts between insurers, binder holders, administrators and funeral parlours should clearly define how security incidents are communicated and who must notify affected parties.

Joint Standard 2 of 2024 sets requirements for reporting material incidents within 24 hours. Ogden says notification arrangements should provide clarity throughout the value chain, including for businesses whose customers may be affected.

4. Assess commercial interests and conflicts

Businesses should understand who controls their policyholder data and whether the provider holding it has other commercial interests involving the customers whose information it manages. Any potential conflicts should be disclosed and appropriately managed.

Data portability forms part of operational resilience

Insurers already report material outsourcing arrangements, but extending visibility to the systems used by binder holders and other intermediaries could help identify additional risks.

This could include recording which systems intermediaries use, who controls those systems and whether the businesses relying on them can export their own records.

Ogden says data portability should be considered alongside access controls, software updates and other security measures when assessing operational resilience.

A system can have strong security protections yet still create a business risk if its users cannot easily retrieve their records or move to another provider.

South Africa’s funeral insurance sector relies on regular premium payments and trust between families and the businesses serving them. Ensuring that policyholder information remains accessible, secure and recoverable is therefore an important part of protecting those relationships.

For funeral parlours and administrators, a practical starting point is to establish where their policy records are held, who controls access to them and how quickly they could retrieve them if their current systems became unavailable.

‘We bring you the latest Garden Route, Hessequa, Karoo news’