Important Notice: Cyber Security Compromise

2 November 2026

Notification of a Security Compromise in terms of Section 22 of the Protection of Personal Information Act, 2013 (POPIA)

AZOZA (Pty) Ltd (AZOZA or we) is issuing this notice to inform potentially affected data subjects of a cybersecurity incident involving a legacy file server within our IT environment.

This notice explains what happened, the personal information that may have been affected, the possible consequences, the steps we have taken and practical measures you may consider taking to protect yourself.

An unauthorised third party gained access to a legacy file server that had previously been used for back-office operations and was in the process of being decommissioned. The forensic investigation has confirmed that certain files were accessed and exfiltrated from the affected environment.

The affected files comprise historical business records relating primarily to activities undertaken between 2021 and 2024, although certain affected records extend into 2025.

AZOZA’s core operational systems remain operational, and there has been no disruption to service delivery.

The affected files contain personal information relating to current and former employees, service providers, clients and other data subjects.

This notice provides information about the incident and the precautionary steps that potentially affected data subjects may take.

The information potentially involved differs depending on the person and the records concerned. It may include some or all of the following:

• Identification and contact information: names and surnames, identity numbers, contact details, physical addresses, service addresses, collection addresses and vehicle pick-up addresses.
• Client and service information: policy numbers, vehicle identification numbers, vehicle registration numbers and information relating to services provided to clients.

• Financial information: banking details and other personal information contained in financial records.
• Employment information: information contained in CVs, personnel, remuneration and payroll records, disciplinary and performance-management records, board-fee records and internal investigation documents.
• Travel-assistance information: members and travellers’ details.
• Other business information: personal information contained in legal, contractual and administrative records.

Not all of these categories apply to every potentially affected data subject. AZOZA will provide further information where appropriate if material findings change its understanding of the incident or the potential risks.

Personal information accessed or acquired without authorisation may be used, alone or together with information obtained elsewhere, to facilitate identity fraud, phishing, social-engineering attempts, impersonation, account compromise or other fraudulent activity. Genuine personal details may also be used to make fraudulent communications appear more convincing.

At this stage, AZOZA has not established that the affected information has been disclosed, distributed, published or otherwise misused. Nevertheless, because files containing personal information were accessed and exfiltrated, potentially affected data subjects should remain vigilant and take the precautions set out below.

Following detection of the incident, AZOZA activated its incident-response procedures. The steps taken include:

• containing and isolating the affected systems;
• engaging independent digital-forensic and cybersecurity specialists;
• conducting a forensic investigation and assessing the affected files;
• implementing additional monitoring and strengthening authentication and security controls;
• notifying the Information Regulator of South Africa; and
• continuing to engage with appropriate legal and cybersecurity advisers.

AZOZA continues to investigate the incident, monitor its environment and assess whether further remedial or notification measures are required.

We recommend that potentially affected data subjects remain vigilant and consider the following precautions:

• Be alert to unexpected communications. Treat unexpected emails, telephone calls, SMS messages, WhatsApp messages and social-media communications with caution, particularly where they create urgency or request personal, banking or authentication information.
• Verify unusual requests independently. Do not rely on contact details or links contained in a suspicious communication. Contact the relevant organisation using its official website, application or a number you already know and trust.
• Protect confidential information. Never disclose passwords, PINs, one-time passwords or other authentication information in response to an unsolicited communication.
• Avoid suspicious links and attachments. Check the sender’s address carefully and access websites or applications directly rather than following an unexpected link.
• Monitor your financial accounts. Review bank statements and account activity regularly and report unfamiliar transactions promptly.
• Strengthen account security. Use strong, unique passwords and enable multi-factor authentication wherever available, particularly for email, banking and other important accounts.
• Review your credit profile. Consider obtaining a credit report from a registered credit bureau and checking it for unfamiliar accounts, applications or enquiries.
• Be cautious with identity documents. Do not provide copies of identity documents, proof of address or banking details unless you have independently confirmed the recipient and the reason for the request.
• Consider protective registration. You may consider applying for free Protective Registration through the Southern African Fraud Prevention Service (SAFPS).
• Report suspicious contact. If anyone claims to possess AZOZA information or approaches you about this incident, do not engage, make payment or follow their instructions. Preserve the communication and report it to AZOZA using the contact details below.

If you have questions about this notice or wish to report suspicious activity relating to the incident, please contact AZOZA’s Information Officer:

Email: informationofficer@azoza.co.za
Telephone: +27 (0) 11 991 9000

AZOZA recognises the importance of protecting personal information and regrets the concern this incident may cause. We remain committed to addressing identified risks and taking appropriate measures to safeguard personal information.

Yours sincerely,

Information Officer
For and on behalf of AZOZA (Pty) Ltd