Story audio is generated using AI
You might think of your local running club as a haven from the stress and anxiety of a busy life, a place to forget your cares — but now you need to worry about the club’s data security.
Sarah Watson, cyber underwriter at the iTOO Special Risks insurance company, told Business Times that malicious actors are targeting sports clubs for the personal data of members, including contact details as well as payment and medical information.
“The profile in terms of organisations is no different,” she said. “Whether it’s a community running club or an organisation as big as Kaizer Chiefs or Orlando Pirates, in this day and age, cyber is no longer a question of being too small to be hit but a matter of how long one will be able to stay free.”
According to cybersecurity research by the Council for Scientific & Industrial Research (CSIR) and the department of communication & digital technologies, 47% of organisations in South Africa that responded to surveys experienced up to five cybersecurity incidents each in 2023-2024. The survey said 88% of respondents reported suffering at least one security breach.
As is the case with businesses, Watson said, larger sports organisations tend to have better cybersecurity than their smaller counterparts. Sports bodies tend to have less secure systems.
“Small organisations are normally quite soft targets. I wouldn’t say that your community running club is going to be a targeted aspect that a hacker from anywhere around the world is going to target. But it’s likely that it is going to be a target of automatic attacks. These are more opportunistic exploits.”
She said state institutions such as the Information Regulator and legislation such as the Protection of Personal Information Act (Popia) improved South Africa’s safeguards against risk, but organisations needed technology, personnel and resources to protect members from harm — and themselves from liability.
Small organisations are normally quite soft targets ... for automatic attacks. These are more opportunistic exploits.
— Sarah Watson, cyber underwriter at the iTOO Special Risks insurance company
“In South Africa ... we have limited cybersecurity resources when it comes to personal information,” Watson said. “One aspect relates to our legislation. Popia came into law in 2021. If you look at the Information Regulator, their claims, fines and payments are picking up. Legally, you are required to notify every data subject of a breach.”
She said online entry systems, membership portals and payment platforms for organisations such as soccer teams and running clubs are designed for ease of access for members but are equally convenient for attackers anywhere in the world.
A cybersecurity skills gap survey by the CSIR found that 33% of respondents indicated that between 21% and 40% of their cybersecurity positions were unfilled, and 29% put the number of unfilled posts at between 41% and 60%.
“The majority (32%) of organisations stated that they could not invest in cybersecurity resources because their business is too small, and 16% stated that they could not afford or see the need to invest in resources to manage their cybersecurity,” the survey report said.
Ciaran Martin, CEO of the National Cyber Security Centre in the UK, said sports organisations are reliant on IT and technology to manage their office functions and, increasingly, their security systems at venues.
“Cyberattacks can have a wide range of impacts; from multimillion-pound fraud to the loss of sensitive personal data.”
Sir Hugh Robertson, chair of the British Olympic Association, said losing access to data, IT or technology can have a significant impact on sports organisations, resulting in data breaches, fraudulent loss of funds and disruption to event delivery.
Business Times
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.