Standard Bank probes RelyComply breach after zero-day attack hit FICA provider

Standard Bank is investigating whether customer information was caught in a cyber incident at RelyComply, the compliance technology provider used in parts of its identity-verification and anti-money-laundering processes.

RelyComply says an unauthorised party appears to have exploited a zero-day vulnerability in a third-party application to access systems holding customer data. The company became aware of the incident on 8 September and has reported it to South Africa’s Information Regulator under reference SC20263150.

For South African banking customers, the important point is that this is a supplier-side breach rather than evidence that Standard Bank’s own banking systems were penetrated. Standard Bank says its services remain operational and secure while its teams work with the provider to establish the scope and any impact on clients.

The weak link sits outside the bank

RelyComply provides KYC and anti-money-laundering technology to financial institutions. Its platform handles processes that can include identity verification, customer screening and transaction monitoring — the sort of compliance work South Africans encounter when completing FICA checks.

The company says the affected environment was taken offline, reset and rebuilt before core services returned. It rotated access credentials, asked customers to rotate API tokens, coordinated refreshes of single sign-on configurations and patched the zero-day vulnerability. RelyComply says continuous monitoring after those measures has not shown further unauthorised activity.

The investigation has not found evidence that the attacker moved from RelyComply into a customer’s own network, according to the company. That distinction matters: a compromise of data held by a supplier can expose customers without requiring an attacker to breach each bank, investment platform or lender separately.

Standard Bank is not the only South African financial-services name tied to the incident. EasyEquities and Satrix have already warned customers of a potential compromise through RelyComply, while SA Home Loans has said information compiled on its behalf was present in the affected environment. The final forensic findings have not yet been published.

The 200GB claim is still a claim

A ransomware group calling itself Dire Wolf listed RelyComply on its leak site on 9 September and claimed to have stolen 200GB of data. That figure has not been independently verified, and RelyComply’s public incident notice does not confirm the volume of data taken.

That leaves two separate facts that should not be blurred together. RelyComply has confirmed unauthorised access to systems holding customer data and a zero-day attack path. The attacker’s claim about the scale and contents of the theft remains unverified.

Standard Bank has activated enhanced monitoring while the investigation continues. It has not said how many South African clients, if any, are confirmed to have had personal information taken through this incident.

The unresolved questions are therefore the ones customers need answered most: which data fields left RelyComply’s environment, how many people are affected, and which of its South African clients will have to issue direct breach notifications. Until the forensic work is complete, the 200GB headline is less useful than the confirmed fact that one compliance supplier sat inside the data chain of several financial businesses.