Old Mutual has told clients that a configuration error at one of its service providers exposed some of their contact details, in an Old Mutual data exposure that the insurer says was not a cyberattack. Moneyweb reported on 16 October 2026 that the exposed information was limited to a mobile number, an email address, or both.
What Old Mutual says happened
According to Moneyweb, Old Mutual said an incident involving one of its service providers “may have resulted in certain customers’ personal information potentially being affected.” The company described it as a configuration error in the service provider’s systems, and said certain files “may have been accessible without the intended security controls.”
Old Mutual stressed that “this was not a cyberattack.” It said it found no evidence of hacking, malware, unauthorised system intrusion or attempts to bypass security measures. It also said there was no evidence that the information was accessed by unauthorised parties or misused.
The wording matters. The files are described as ones that “may have been accessible.” Old Mutual is saying the data could have been viewed because of the error, not that anyone viewed it. The statement that nobody did is the company’s own finding, and the reports we reviewed carry no independent confirmation of it.
What data was involved
The personal information involved was limited to certain data fields: a mobile number, an email address, or a combination of the two. Moneyweb reports that some records contained only free-text responses and no personal information about identifiable people.
Old Mutual told clients that their policies, benefits and accounts remained unaffected. The Moneyweb report does not list every category of data that was not exposed, so Old Mutual’s statement to clients is the best guide on that point.
How the company responded
Old Mutual sent precautionary messages to potentially affected clients, saying there was no indication of unauthorised use of the information. The messages warned clients not to share their PIN, password or one-time passwords.
The company said the issue had been resolved and that steps had been taken to strengthen safeguards against a recurrence. It said it notified potentially affected customers proactively, in line with its obligations under the Protection of Personal Information Act (POPIA), and expressed regret for any concern caused.
What is still unknown
The report leaves several questions open. Old Mutual has not said how many clients were affected, and the Moneyweb report gives no number. It does not name the service provider, say how long the files were accessible, or explain how the error was found. It also does not say whether the Information Regulator has been told, or whether the service provider faces any consequences under its contract with Old Mutual.
We found no second outlet carrying the story at the time of writing, so everything above rests on Moneyweb’s reporting of Old Mutual’s statement. Moneyweb links the story to related coverage of a data breach affecting EasyEquities and Satrix and to a piece on POPIA enforcement, which suggests data incidents at financial firms are drawing attention, but those reports describe separate matters and we have not reviewed them.
What affected clients should know
Old Mutual’s own advice is that clients keep their PIN, password and one-time passwords private, and it says their policies, benefits and accounts are not affected. A client who receives an unexpected call, SMS or email about a policy should treat it with caution and use Old Mutual’s official channels to check it, rather than replying to the message.
Because the incident sat with a service provider, it also raises a practical point for any business that hands customer data to outside firms: Old Mutual is the name on the notice sent to clients, not the provider’s. We will update this report if Old Mutual or the Information Regulator publishes further detail. For more on data and compliance, see our Regulatory and Policy coverage.
