Please read this notice and take the steps in section 6.
1. What happened
Cartrack provides vehicle tracking services and processes some client information for Mobalyz in connection with those services.
On 15 September 2026, Cartrack told us about the possible effect of a security incident on personal information. Cartrack says it detected a ransomware incident on its platform on 26 August 2026, and that information in its customer database was accessed.
Cartrack told us that its investigation had confirmed that some of the information accessed was published online on 8 September 2026. Cartrack’s public notice says that information may have been published on a restricted-access site used by the attacker. Cartrack says it believes a ransomware group known as “Direwolf” was responsible.
The security compromise Cartrack reported occurred on Cartrack’s platform.
2. What information may be involved
Cartrack has told us that the information in its customer database may include:
- your name, email address, telephone number and physical address;
- bank account information, such as the account holder name, bank, branch code and account number; and
- certain vehicle and driving-related information.
We have asked Cartrack what the vehicle and driving information includes. Cartrack has not yet answered.
3. Whether your information is affected
We do not yet know whether your information was involved. Cartrack has not yet identified which Mobalyz clients are affected, or what information relating to each affected client was involved.
Because of that, we are sending this notice to every Mobalyz client whose vehicle is fitted with a Cartrack device, so that you can take protective steps now.
4. What this could mean for you
Criminals may use this information to contact you while pretending to be Mobalyz, Cartrack, your bank or an insurer. Because they may know real details about you, such as your name, your vehicle or your banking details, their message or call may sound genuine.
The risks include:
- attempts to get you to pay money into a different account;
- attempts to get your PIN, password or one-time PIN (OTP);
- attempts to open accounts or obtain credit in your name; and
- messages or calls that pressure you to act quickly.
5. What we have done
- We asked Cartrack to tell us what happened, which of our clients are affected and what information was involved.
- We changed our passwords for the Cartrack platform and removed unused user accounts.
- Cartrack has told us that it reset the connections between its platform and ours, and issued new connection details.
- A precautionary fraud warning is being sent to clients by SMS in batches from 18 September 2026.
- We briefed our customer service, collections, claims and refund teams, and tightened the checks we do before any change to banking or payment details.
- We notified the Information Regulator on [DATE OF FILING].
- We are continuing to investigate.
This notice may be updated if further information changes what clients need to know or do.
If you have already lost money or shared a PIN or OTP
Call your bank’s fraud line immediately, using the number on the back of your card or in your banking app. Ask them to stop the payment and to secure your account.
Then report the matter at your nearest police station, and tell us on 011 550 9300.
6. What we recommend you do
- Do not change your banking details, and do not pay into a new account, because of an unexpected call or message. Contact us first on 011 550 9300.
- Never share your PIN, password or OTP with anyone, including someone who says they work for Mobalyz, Cartrack or your bank.
- Do not click links in messages you were not expecting.
- Check your bank statements. Tell your bank immediately about any payment you do not recognise, and ask your bank about a fraud alert on your account.
- Apply for a free Protective Registration with the Southern African Fraud Prevention Service at www.safps.org.za. It asks banks and credit providers to take extra care before opening accounts in your name.
- Check your credit report for activity you do not recognise. You may request one free credit report each year from a registered credit bureau.
- Cartrack has asked its customers to update their Cartrack passwords as a precaution. If you used that password anywhere else, change it there too.
- Report any suspicious call or message to us.
7. How to contact us
- WhatsApp: 011 550 9300
- Email: customerservice@mobalyz.com
- Information Officer: dpo@mobalyz.com
For questions about Cartrack’s own service, Cartrack asks customers to use its WhatsApp number, +27 11 250 3000, or to email cyberincident@cartrack.com.
8. Your rights
You may ask for access to the personal information we hold about you, and you may ask us to correct or delete it, or object to how we use it, where POPIA allows. Write to dpo@mobalyz.com.
You may also complain to the Information Regulator. Details are at www.inforegulator.org.za.
We understand that this is concerning, and we are taking it seriously.
