August 7, 2024
This notice is only applicable to citizens of the Republic of South Africa.
Dear Sibanye-Stillwater Stakeholder
In early July 2024, we discovered that a cyber-attack had compromised certain Sibanye-Stillwater ICT systems. As is common with cyber-attacks of this nature, we have not been able to identify the individuals responsible for this malicious conduct and are cooperating with law enforcement. This notice serves to inform you that certain personal information in South Africa that was provided to us during the course of your relationship with the company may have been exposed.
At Sibanye-Stillwater, we take the privacy and security of our stakeholders’ data seriously, and we have taken considerable measures to ensure the safety and integrity of our stakeholder information. We believe there is limited risk to data subjects in relation to the information that may have been accessed, however, we will continue to monitor the situation. As an added precaution, we recommend that you remain vigilant and be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information. We regret any inconvenience which may have resulted from this incident.
Potential information that might have been accessed
For individuals, the data may include, where applicable, personal details such as your name; ID or passport number; contact details; demographics; education and employment history; trade union membership; financial; and health information.
For businesses, possible categories of information may include, where applicable, business name; registration and VAT numbers; contact and banking details; and information contained in contracts.
Steps that have been taken since the cyber-attack occurred
As soon as we became aware of the cyber-attack, our Incident Response Plan was initiated and we immediately engaged leading external cybersecurity experts and forensic firms to assist our ICT team to contain the incident, determine the scope of the attack, and take prompt action to secure our systems.
The cyber-attack has been contained, but we remain vigilant and are closely monitoring all systems for any further activity. To minimise the chances of cyber-attacks in the future, we have and are implementing further measures to enhance the security of our network, systems and data. Sibanye-Stillwater is committed to continuous improvement and will continue to evaluate and implement additional available steps to further refine the security of our environment.
We have notified the South African Information Regulator and relevant law enforcement. We are cooperating with all relevant authorities as appropriate.
Potential use of the information
Please be aware that access to personal information can create a heightened risk of criminals attempting to impersonate you or trick you into disclosing further information about yourself or your organisation. This could potentially be used by third parties in various ways to commit fraudulent scams, digital profile hacks, identity theft or to intercept your communications.
Precautionary steps that can be taken
As a precaution, we advise following these security guidelines as good practice to protect yourself:
- To mitigate against the risk of fraud, you can place a fraud alert on your credit report at any of the major credit bureaus
- You can register for a free Protective Registration listing with Southern Africa Fraud Prevention Service to help protect you against the risks of compromised identity information at: https://www.safps.org.za/Home/OurServices_ApplyProtectiveRegistration)
- Remain vigilant against any suspected unauthorised use of your personal information
- Be cautious of any unsolicited communications that ask for your personal information or that refer you to a web page asking for personal information: fraudsters often pose as officials from trusted authorities like the police or banks
- Change your passwords regularly, do not use the same password for business and private activities and never share these with anyone else
- Avoid clicking on links or downloading attachments from suspicious emails
- Make sure your cyber training, particularly regarding malicious attacks (phishing etc.) is up to date
If you have any questions or require further assistance, please contact ictservicedesk@sibanyestillwater.com or call +27 (0) 800 333 461 or +27 (0) 800 00 1080.
