South Africans have yet again had their private data exposed on the internet due to sloppy software management. Illustration: Lisa Nelson
- Many companies record telephone conversations with customers.
- Thousands of such conversations, many dealing with medical scheme queries, were exposed on the internet by a Gqeberha-based software company, which misconfigured a server.
- After GroundUp discovered this, we notified the companies involved and the audio files are no longer accessible to the public. But the files were available on the internet for about two months and it is likely that others discovered and downloaded them.
When you call a financial company, and you’re on hold with a message saying “Your call is being recorded for quality and security purposes,” you rightly expect that the conversation you eventually have with the human on the other end is confidential and secure.
Unfortunately many South Africans have been let down.
On Wednesday night we discovered that Open V, an IT company, had left thousands of recordings of one of its customer’s telephone calls available to download off the internet. As far as we can tell, these recordings, which go back to 27 July, had been available since 6 September.
Based in Gqeberha and operating since 2006, Open V says on its website that it specialises in a range of IT services, including cybersecurity, “ensuring that medium and large businesses stay ahead in a rapidly evolving digital landscape”. Its “managing executive” is Siva Naidoo and its “chief information officer” is Stuart Kemp.
Where it was possible for us to identify them, the voice recordings were either incoming, outgoing or internal to Edge Financial Group, a Gqeberha financial services company that, among other things, brokers medical scheme cover. Many of the calls were made by Edge employees to Discovery or Bonitas. Thousands of the calls were of substantial length. We downloaded a few dozen of the audio files to understand what was going on. As soon as participants began to discuss medical or financial information, we stopped listening. Based on the conversations we sampled, they mostly involved medical scheme queries.
We contacted Discovery and Edge on Thursday morning to inform them what was happening. Officials from both companies were alarmed, immediately took action and assured us that the matter would be reported to the relevant authorities. (Many other companies were involved in the recordings, but we only contacted Edge because it was the Open V customer whose data was breached and Discovery because it is the largest medical scheme in the country and a large number of the calls involved Discovery. We emphasise that neither company had control over what happened here.)
Edge’s managing director, Edward Gutsche, wrote to GroundUp: “To date we have ensured that our FSCA compliance officer has been notified and shall also be awaiting the report [from Open V] so that he can, if need be, inform FSCA.”
“I am quite angry, if it is verified in the report, that Edge as a client of Open V, has had our rights and our clients’ rights prejudiced and that (with no insult intended) it was a media organisation that picked up on the alleged breach instead of Open V themselves,” wrote Gutsche.
A company that discovers a data breach must, in terms of the Protection of Personal Information Act (POPIA), notify the Information Regulator and, where possible, the people whose data has been exposed.
We also contacted Open V on Thursday morning by email and phone. About half an hour after we told an Open V employee about the problem, the site was taken offline. Open V, instead of responding to our questions, sent us the letter in the box below.
Easily available
We used a tool called Shodan to identify the publicly accessible site. Security consultants, students, as well as hackers, some with ill intentions, use Shodan for this purpose. No password guessing or unlawful actions were involved; this data was exposed due to a configuration error by Open V.
With the URL (an IP address in this case), no technical skills were required to access the files; you simply had to click on them, and they would be available in your browser.
Besides over 9,000 audio files (of which at least 1,900 were of substantial length, i.e. not merely dropped calls), the site included exposed databases, usernames, passwords and proprietary source code.
One possible avenue of attack for hackers with criminal motives would be to use information gleaned from the audio files to impersonate employees of Edge or one of the medical schemes and con clients into diverting payments. There is also potential for blackmail or merely maliciously embarrassing people in relation to confidential medical data. Another avenue could involve accessing the database directly and reading client information from it.
The data had been indexed by Shodan for almost two months (at least) and seems to have been exposed since that time. Since it is common for Shodan users to find these breaches easily (the tool lets users search for unprotected folders like this one), we would not be surprised if the data has been accessed by many humans and bots.
Letter from Kuban Chetty, director of Open V to GroundUp
We put this letter through Pangram, which assessed that it is AI-generated.
Dear Mr Geffen
-
We act for OPEN V and refer to your email of 5 November 2026 at 11:05, indicating an intention to publish by 11:00 tomorrow. Please refer this correspondence immediately to your editor.
-
Your notification of a potential exposure is acknowledged. However, your questions proceed from unestablished conclusions: that OPEN V allowed the alleged exposure, breached confidentiality and may have brought a product to market without sufficient security competence. Your email also associates OPEN V with “V-Connect/Shiftbridge” without explaining the respective entities’ roles or the evidence supporting that attribution.
-
The existence of an accessible directory does not, without further investigation, establish who owned, hosted, configured, administered or controlled the relevant system, who was responsible for its security, or the cause and extent of any exposure. Our client does not admit the allegations or attribution of responsibility in your email. Equally, this response should not be represented as a technical finding that no exposure occurred.
-
We require your written undertaking that, pending verification of these material matters and a reasonable opportunity for our client to respond, GroundUp will withhold publication identifying OPEN V, directly or indirectly, including through its name, branding, personnel, product references or links. We further require that you refrain from publishing unsupported allegations or insinuations of negligence, unlawful conduct or technical incompetence concerning our client.
-
The Press Code requires the media to “take care to report news truthfully, accurately and fairly” (clause 1.1). Clauses 1.2, 1.3 and 1.7 require proper context, differentiation between fact and allegation, and verification of doubtful information. Clause 1.8 requires a reasonable opportunity to respond. Clauses 3.3 and 4.1 address reputation and the protection of personal information held by the media. A request for comment does not, by itself, cure an unsupported attribution of responsibility.
-
In National Media Ltd v Bogoshi 1998 (4) SA 1196 (SCA), the Court recognised a defence of reasonable publication, assessed against all the circumstances, including the seriousness of the allegation, verification and the opportunity afforded for a response. Public interest does not dispense with those requirements. Publishing the conclusions embedded in your questions without adequately establishing their factual basis may expose the responsible parties to liability.
-
Please urgently provide the factual and technical basis for attributing responsibility to OPEN V; the basis for associating it with V-Connect and Shiftbridge; the dates, times and methods of the observations relied upon; and whether any recordings were accessed, downloaded, copied or disclosed. We do not request disclosure of confidential journalistic sources. Any necessary technical evidence must be exchanged through an agreed secure channel, without circulating the underlying sensitive recordings by ordinary email.
-
We also require an undertaking that you will not publish recordings, transcripts, identifiable medical or financial information, or live addresses, directory paths or instructions that facilitate further access. Preserve relevant evidence securely, restrict access to those who require it for a lawful purpose, and avoid further unnecessary access or copying. Apparent internet accessibility does not, by itself, establish consent to unrestricted use or republication.
-
Please confirm the undertakings within two hours of receipt and agree to defer the proposed publication for 48 hours beyond your stated deadline, with any further extension to be discussed promptly. If you decline, identify precisely which undertakings you refuse and your intended publication time. Pending a substantive response, any report must fairly reflect that responsibility has not been established and that OPEN V disputes the assumptions in your questions.
-
Should unlawful publication be threatened or occur, our client reserves its rights to seek appropriately confined urgent interdictory relief where the legal requirements are met, correction or retraction, relief through the Press Council where applicable, recovery of proven patrimonial loss where legally recoverable, and costs. This correspondence will be relied upon insofar as relevant to notice, reasonableness and costs.
-
Nothing herein restricts lawful reporting or required disclosures to competent authorities. All our client’s rights remain reserved.
Yours faithfully
Kuban Chetty
Director
© 2026 GroundUp. This article is published under the GroundUp Republication Licence Version 1.0. Email [email protected] to request permission to republish.
