RelyComply cyber incident: what happened and what you can do

Published 16 September 2026 | Last updated 2 November 2026

On 8 September 2026, RelyComply became aware of a cyber incident involving unauthorised access to part of the environment where we process information on behalf of some of our customers.

We immediately activated our incident response procedures and appointed independent cybersecurity and forensic specialists to investigate the incident, contain the threat and assess its impact.

The independent forensic investigation was concluded on 1 October 2026. This page has been updated to reflect the confirmed findings, the steps we have taken and the precautions individuals can take to protect themselves.

What happened?

The independent investigation confirmed that an unauthorised third party exploited a zero-day vulnerability a third-party software application used by RelyComply for internal reporting.

A zero-day vulnerability is a newly discovered software security weakness that attackers can exploit, sometimes before organisations have had sufficient time to respond. 

The attacker used the previously unknown vulnerability to gain access to the reporting application and obtain credentials that enabled access to certain connected systems containing customer information.

What did the investigation establish about customer information?

The forensic investigation confirmed that data was removed from RelyComply’s environment.

However, the available forensic evidence does not allow us to determine conclusively which individual records or specific fields were removed.

For this reason, we took a precautionary approach when notifying customers, identifying the broader scope of information that could potentially have been accessed rather than limiting notifications to information we could prove had been removed.

Depending on the services used by an affected organisation, the information potentially involved may include identity and contact details, compliance screening and risk-assessment information, transaction-related information and, in certain cases, identity-verification records or documents.

Not all these categories apply to every affected individual. Each affected customer has been provided with information specific to its services and potentially affected data.

As at the date of this update, we have not identified verified evidence that the information removed has been publicly released, sold or used fraudulently. We continue to monitor for any evidence of publication or misuse.

What has RelyComply done in response?

Our priority has been to contain the incident, secure the environment and address the weaknesses identified through the investigation.

The principal measures undertaken include:

• Containment and recovery: Affected systems were taken offline, and the environment was reset and rebuilt before core services were restored.
• Access security: Relevant passwords, access credentials and security keys were reset. Customers were also supported with the renewal of their access credentials where required.
• Removal of the affected application: Metabase has been permanently decommissioned and will not be reinstated.
• Stronger vulnerability management: Automated monitoring for newly identified software vulnerabilities and security updates has been expanded across our systems, together with stricter requirements for responding to critical vulnerabilities.
• Enhanced security controls: Additional access restrictions, multi-factor authentication, monitoring, logging and automated security alerts have been implemented.
• Independent assurance: External cybersecurity specialists have supported the investigation and remediation. We have also completed an updated independent penetration assessment and are continuing to address and verify findings through our ongoing security improvement programme.
• Ongoing security oversight: We have expanded the involvement of our external security partners to provide additional monitoring, technical support and oversight alongside our internal team.

These measures form part of a broader programme to strengthen our security controls and ensure that the lessons from the incident are incorporated into our ongoing security practices.

Has the incident been contained?

Yes. The independent forensic investigation confirmed that the incident was contained following the measures implemented by RelyComply.

Subsequent monitoring has not identified further active exploitation associated with this incident, and the original means of access has been removed.

Although the forensic investigation has concluded, security monitoring, vulnerability management and independent assurance activities remain ongoing.

Was my bank’s or service provider’s own system affected?

The incident involved systems within RelyComply’s environment.

The investigation found no evidence that the attacker gained access to, or moved into, any customer’s own network environment.

Separately hosted private customer environments were not affected by this incident.

It is important to distinguish between a customer’s own systems and information that the customer had provided to RelyComply for processing. Although customer systems were not found to have been compromised, certain information held by RelyComply for its customers may have been accessed.

Who was responsible?

A threat actor has publicly claimed responsibility for the incident. However, the identities of the individuals involved have not been independently established.

RelyComply has not engaged with the threat actor.

Have RelyComply’s customers been notified?

Yes. We notified the customers whose information was potentially affected and provided details of the relevant information and records to assist them with their own regulatory and notification obligations.

RelyComply processes personal information on behalf of its customers, including banks and other financial service providers. These organisations are generally responsible for determining whether and how to notify their own customers and other affected individuals.

We continue to support them in that process, including responding to requests for information arising from individual notifications.

Has the incident been reported to the Information Regulator?

Yes. RelyComply reported the incident to the Information Regulator of South Africa on 10 September 2026 under reference SC20263150.

We continue to cooperate with the Information Regulator and have also engaged with other relevant financial-sector authorities.

What should I do?

If you have been notified that your personal information may have been involved, we recommend taking the following precautions:

• Monitor your bank accounts for unusual or unauthorised transactions and report anything suspicious to your bank immediately.
• Remain alert to scams and impersonation attempts. Criminals may use genuine personal details to make fraudulent emails, telephone calls or messages appear more convincing.
• Never share passwords, PINs or one-time passwords (OTPs) in response to unsolicited communications.
• Contact your bank or service provider through its official channels if you receive an unexpected request involving your personal or financial information.
• Consider registering with the Southern African Fraud Prevention Service (SAFPS) for identity-fraud protection at www.safps.org.za.
• Review your credit report for any unfamiliar accounts or enquiries.
• Use strong, unique passwords and enable multi-factor authentication wherever available.

These are sensible precautions even where there is no evidence that your specific information has been misused.

Nobody has contacted me. Could I still be affected?

Not receiving a direct notification does not necessarily mean your information was involved, or that it was not.

The information potentially affected differs between RelyComply’s customers and the services they use. Relevant banks and service providers are best placed to confirm whether your information falls within the scope of their notifications.

If you are concerned, we recommend contacting your bank or service provider through its official website or customer-support channels.

Please also note that some organisations may issue notifications through their websites or other communication channels.

What happens next?

The independent forensic investigation concluded on 1 October 2026, and the immediate incident containment and recovery activities have been completed.

Our focus remains on maintaining the strengthened security controls, continuing independent security assurance, monitoring for any potential misuse of information and supporting affected customers with any ongoing obligations.

We recognise the seriousness of the incident and the concern it has caused. We have implemented a number of improvements to further enhance our cybersecurity as a result of lessons learned from this incident. 

We will update this notice if new material information is verified that changes our understanding of the incident or the guidance provided to potentially affected individuals.

If you have questions about whether your personal information may have been affected, please contact your bank or service provider directly. For questions about RelyComply’s incident response, you can contact incident@relycomply.com.