Security Vulnerabilities

Sedibelo Resources Limited and its subsidiary, Pilanesberg Platinum Mines Proprietary Limited (collectively “Sedibelo” / “our” / “we” / “us”) wish to inform our staff, clients, customers and other stakeholders in respect of an information security compromise detected on 10 July 2023 (“the incident”)

Sedibelo is not aware of any personal information that has been published or misused as a result of the incident.

This notice provides information relating to the incident as well as the actions we have taken since the incident was detected to mitigate possible adverse effects, and to ensure that any affected data subjects are aware of the incident and can take steps to secure their information should they deem it appropriate.

This notification is made in compliance with section 22 of the (South Africa) Protection of Personal Information Act, 2013 (POPIA).

Overview of the incident

Sedibelo became aware that its IT environment had been unlawfully accessed by an unknown and unauthorised third party on or about 10 July 2023, causing certain servers and drives within Sedibelo’s IT environment to be accessed and data encrypted using ransomware.

We immediately launched a digital forensic investigation with the assistance of external cybersecurity specialists. It was determined that information (including personal information) relating to Sedibelo was exfiltrated by an unauthorised third party. The forensic investigation is currently ongoing to determine the cause, scope and impact of the incident. The identity of the unauthorised party has not been established.

The incident has had no impact on Sedibelo’s mining and processing operations and has had only a limited impact on Sedibelo’s other operations as we were able to reinstate full operability to our IT systems within 4 days of the incident being detected.

No other suspicious activity in Sedibelo’s IT environment has been detected since the initial discovery of the incident.

What we have done

Sedibelo takes the confidentiality, privacy and security of data and personal information in our care very seriously. We acted promptly to investigate the incident as well as keep our staff updated on our progress to contain and resolve the incident.

Security safeguards are already in place to protect data and personal information under our control. Furthermore, the following additional IT security measures have been implemented since the resolution of the incident:

• Engaged Cybersecurity experts to assist in identifying, containing and remediating threats,
• Changed login credentials i.e reset passwords on all accounts and revoked access on compromised accounts. Enforced multi-factor authentication
• Patch identified vulnerabilities on all systems and ensure firmware across appliances are up to date.
• Monitor the publication of any information relating to Sedibelo and its related entities including any personal information on the internet and the dark web. To date, there is no indication of any such publication.

Possible consequences to data subjects

The full extent of the incident and any impacted personal information is presently unclear, but investigations are continuing.

We recommend that all data subjects remain vigilant on any suspicious activities or fraudulent communication they may receive, specifically in relation to requests for banking information and secondary extortion attempts.

We encourage you, in accordance with best practice, to also maintain these security measures:

• Do not disclose personal information such as passwords and PINs when asked to do so by anyone via email, phone, text messages or fax.
• Verify all requests for personal information and only disclose it when there is a legitimate reason to do so.
• Do not click on any suspicious links.
• Change your passwords regularly, using passwords with length and complexity, and never share these with anyone else.
• Perform regular anti-virus and malware scans on your personal computer and mobile device, using software that is up to date.
• Scrutinise email addresses and ensure they are genuine before responding or opening the attachments.

For more information If you have any questions or concerns, please write to us at Legal@sedibeloresources.com