Profmed Data Breach
Profmed has alerted its customers to a data breach originating from compromised third-party providers involved in the administration of the medical aid scheme. The incident was identified by Profmed’s administrator, PPS Healthcare Administrators (PPSHA). Customers were notified on the evening of Wednesday, June 25, 2026.
Details of the Breach
- Nature: An unauthorized individual gained access to service provider systems using compromised login credentials, potentially accessing and removing member information.
- Affected Information: The accessed data may include member names, identity numbers, contact details, membership numbers, and scheme option information.
- Risks: This information could be exploited by scammers for targeted phishing attacks, leading to banking fraud, unwanted contact, attempted fraud, impersonation, or social engineering.
- Unaffected Systems: PPS Healthcare Administrators confirmed its own systems were not compromised; only third-party services were affected. The compromised environment has since been secured.
Parties Involved
- Profmed: The medical aid scheme that notified its customers. It is described as South Africa’s largest restricted and graduate professional scheme.
- PPS Healthcare Administrators (PPSHA): Profmed’s administrator, which identified the incident. PPSHA is the fourth-largest medical scheme administrator in South Africa, serving over 200,000 clients and administering services for multiple medical aid schemes.
- External Experts: Profmed and PPSHA are collaborating with cybersecurity specialists and legal advisors for investigation and safeguarding.
Actions and Recommendations
- Containment: Steps have been taken to contain the incident, strengthen security, and prevent further unauthorized access, including isolating affected systems and resetting credentials.
- Regulatory Notification: PPS Health Administrators is notifying the Information Regulator of South Africa as required by POPIA.
- Customer Communication: Profmed and PPSHA are committed to ongoing communication with customers regarding the incident.
- Vigilance: Beneficiaries are advised to be vigilant against suspicious communications requesting financial information.
Broader Context
This breach occurs amidst a significant rise in cybersecurity incidents in South Africa since the start of 2026, with local companies reportedly breached frequently. Threat actors are increasingly leveraging AI for cyberattacks across the continent, mirroring advancements that enable AI models to identify security weaknesses with high accuracy.
Courtesy of Medical Billing Software