← South Africa Cyber Watch

MIP Holdings breach exposes clients of about 45 insurers

South African insurance software supplier MIP Holdings lost about 400,000 support records in mid-2026, touching customers of some 45 insurers. MIP paid a ransom, and The Gentlemen later published Hollard funeral policyholder data anyway.

Key facts

1. OrganisationMIP Holdings, which supplies administration software to South African insurers. Hollard is one affected client.
2. What happenedIntruders got in around 25 May 2026 and MIP noticed in mid-June. They reached a Jira support platform MIP was retiring and took about 400,000 records.
3. Data affectedID numbers, email addresses and cellphone numbers pasted into support tickets. Leaked Hollard data includes funeral policyholders' names, their children's names, ID numbers and emails.
4. Cause or entry pointAn employee had reused credentials from an unrelated service that was itself breached, TechCentral reports.
5. Not affectedHollard says its forensic work found no compromise of its own systems. LegalWise says there is no sign its core systems were accessed.
6. ClaimedThe Gentlemen listed Hollard and later LegalWise, Samwumed, Edcon and Guardrisk. TechCentral could not verify a MIP link for all of them.
7. AuthoritiesThe Information Regulator says MIP's was the only notification it received and that each insurer must notify. It says a ransom payment does not settle POPIA duties.

Timeline

1. 25 May 2026Intruders gain access to MIP's systems, around this date. MIP notices in mid-June. TechCentral
2. 26 Jun 2026LegalWise says MIP found unauthorised access to a legacy development and support system. TechCentral
3. 7 Sep 2026The Gentlemen list Hollard on their leak site. MIP links the material to its June breach. TechCentral · ransomware.live
4. 18 Sep 2026Hollard says the leaked funeral policyholder data came from the MIP incident. MIP's CEO says MIP paid a substantial ransom and about 45 insurers were affected. TechCentral · ITWeb
5. 5 Oct 2026The Gentlemen add LegalWise, Samwumed and Edcon with countdowns to 9 October. The Information Regulator sets out insurers' duty to notify. TechCentral

Affected organisations

Organisation	Date	Sector	Type	Actor	What happened	Sources
✅ ConfirmedHollardVia a vendor	7 Sep 2026	Finance	Data leak	The Gentlemen	Confirmed. MIP linked the Hollard material to its June breach. Hollard refused to pay and says its own systems were not compromised. Claimed. The Gentlemen listed Hollard and published funeral policyholders' details.	TechCentral · ransomware.live✓ 8 Nov
✅ ConfirmedMIP Holdings	26 Jun 2026	Other	Data leak	The Gentlemen	Confirmed. Insurance software supplier MIP confirmed attackers used reused staff credentials to reach a support platform and took about 400,000 records tied to some 45 insurers. MIP paid a ransom, and data was published anyway.	TechCentral✓ 8 Nov

What to do

• If you hold a policy with a South African life or funeral insurer, ask it directly whether it uses MIP and whether you were notified.
• Apply for free protective registration with the Southern African Fraud Prevention Service (safps.org.za) if your ID number was exposed.
• Be wary of calls, SMS and emails about your policy that ask for banking or personal details. Call your insurer on its official number.
• Complain to the Information Regulator (inforegulator.org.za) if your insurer has not told you what happened.

FAQ

Related stories

• Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
• Bank Rakyat website defacement Malaysia · 6 Nov 2026
• M1 customer data breach Singapore · 6 Nov 2026
• Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026

Checked 8 Nov 2026. Methodology · Data CC BY 4.0