South Africa: Your Call Is Being Recorded - and Broadcast to the Internet

What the report says

GroundUp reported that thousands of telephone recordings involving South African customers were left publicly accessible online after a Gqeberha-based IT company, Open V, misconfigured a server. The exposed files reportedly included calls linked to Edge Financial Group, a financial services company that brokers medical scheme cover, and many appeared to concern sensitive medical aid queries. The article says the recordings were available for roughly two months before GroundUp alerted the companies involved, after which the files were taken offline.

According to the report, the exposed material dated back to late July and was accessible without special technical skill. GroundUp said it used a public search tool to locate the files and also found exposed databases, usernames, passwords and source code on the same system. The publication said it downloaded only a limited number of audio files to verify the nature of the breach, then stopped listening once confidential information began to appear.

GroundUp said both Edge and Discovery were informed and reacted quickly, and that Edge told the publication it had notified its compliance officer and would await a report from Open V. The article also notes that, under South Africa’s POPIA law, organizations must notify the Information Regulator and affected people when personal data is exposed, where possible.

The incident matters because it potentially exposed private medical and financial information and illustrates the risks of poor security configuration in systems that handle customer calls. Open V disputed GroundUp’s attribution and asked that publication be withheld pending verification, while not admitting the allegations.