Director’s View

The Twenty-Minute Promise

Fifty degrees in the Richtersveld

A little after two in the afternoon on the second day of the 2017 West Coast Baja, Kim stopped beside a rider in the Richtersveld who was standing next to his bike with his helmet still on, hunched forward over the seat. He had nothing to drink and told her he could not carry on. Race Control in Port Nolloth had assured us that help would get to us within twenty minutes of a call. “Twenty minutes,” she whispered to herself. “Twenty minutes and help will be here.”

I was not out there. Shortly before the rally I had flipped a dirt bike in training and torn three of the four rotator cuff muscles in my right arm, which is how a man who had entered the race ended up as pit crew in Port Nolloth. What I did contribute was a satellite phone, insisted on because of a feeling about the whole setup that I could not shake. Kim objected, fairly, that it was expensive and added a kilogram to a backpack heavy enough already.

The designated radio channel returned nothing and there was no cellphone signal. In the dip where she had stopped, the satellite phone could not find a satellite either, so she left him leaning against his bike and walked up a koppie until it did. She called Race Control, and nobody answered. She called me, and by then the Richtersveld had pushed the temperature to 50 degrees.

I passed her coordinates to the race marshal and was promised the twenty minutes. Forty-five minutes later there were still no paramedics, and Race Control told me the coordinates they were working from would take the medics across the Orange River into Namibia. The rider was Gary Rowley. He died out there with Kim beside him, before the paramedics arrived.

What sat in the support tickets

From late May until mid-June 2026, a group known as The Gentlemen sat inside a support platform belonging to MIP Holdings, which supplies policy administration and CRM software to South African insurers. They did not break through MIP’s perimeter. An employee had reused their login details on an unrelated service that had itself been breached, and the attackers came in through that employee’s personal laptop. The platform was the one MIP’s clients used to log support tickets, and MIP was in the middle of retiring it.

Those tickets were meant to carry masked data. They carried the real thing. According to MIP’s chief executive, Richard Firth, a client’s staff member logging a problem would paste in whatever they were looking at, and the record underneath came with it. Some 400,000 records went, belonging to the customers of about 45 insurers and carrying ID numbers, policy numbers, email addresses and cellphone numbers. Firth told TechCentral the company was taken aback to find that data there at all. He has spoken on the record because breached companies tend to hide it and silence helps nobody. That deserves credit.

MIP paid the extortionists for an undertaking that the data would be destroyed. The undertaking was not honoured. On 7 September the group listed Hollard on its leak site, and by 18 September TechCentral had seen the names of Hollard funeral policyholders, the names of their children, their ID numbers and their email addresses published online. Hollard says its own forensic work has found no evidence of compromise inside its environment, and TechCentral reports that it refused to pay.

The model pilots are trained on

Pilots are trained on a model for exactly this, and I have never found a better one for a boardroom. The British psychologist James Reason pictured every defence as a slice of Swiss cheese. Every slice has holes, because every safeguard has weaknesses, and on an ordinary day the holes in one slice are covered by the solid parts of the next. An accident needs the holes to line up all the way through.

Both stories are stacks of cheese. The rally’s organisers had nominated a radio channel and assured us of a helicopter on standby and paramedics in 4x4s who could reach us within twenty minutes of a call. MIP had a perimeter that held and a rule that support tickets would carry masked data. On paper, nothing was missing. On one afternoon in the Richtersveld, and across about three weeks inside MIP, enough of the holes lined up anyway.

The hole is usually in the handover

What stays with me is where the holes were. Kim did everything right. She gave the man her emergency Powerade, marked their position on her GPS, checked it against her Suunto watch and photographed the watch with her phone in case it died. Hollard, by its own account, held too. In both stories the holes that mattered sat in the joins, the places where one party’s slice hands over to somebody else’s.

The coordinates are the join that still gets me. Off-roaders work in degrees, minutes and seconds, which is what Kim’s watch was set to and what the organisers had told every competitor to use at the briefing. The paramedics, it dawned on me that afternoon, were reading her position as decimal degrees. Both formats are correct. Read one as the other and you can be out by hundreds of kilometres, which is how a medical team came to be heading for Namibia while Kim was still in the Richtersveld. It is a perfectly good kettle and a perfectly good wall socket with a plug from the wrong country in between. Nothing is broken. Nothing works.

MIP’s plug was a rule. The rule said support tickets would carry masked data, and the people logging the tickets worked for the clients and pasted in whatever was on their screens. A rule written on one side of a join does not bind the fingers on the other.

And a system on her way out is the loneliest member of any company, because everybody’s attention has already moved to her replacement. If MIP’s old support platform could have said anything in May, I suspect she would have said this: “You have all started talking about me in the past tense. Nobody has asked what I am still carrying.”

The lesson I carry out of the Richtersveld is this. Never take it for granted that something is organised unless you have organised it yourself. And even then, expect it to come apart where somebody else takes over.

What I cannot claim

I owe you a concession. I will never know whether paramedics arriving inside twenty minutes would have saved Gary. The race organiser announced that night that he had died of a heart attack, and I am not a doctor. The holes lined up. That is all the story proves, and I will not pretend it proves more.

There is a harder one about me. My own slice had a hole in it: the satellite phone I insisted on could not see the sky from the dip where Kim needed it, and she had to leave a man in trouble to climb a koppie before it worked. And I run an IT company. Somewhere in a client’s stack there is a slice with our name on it, and it has holes like every other slice. A chief executive who sells slices telling you to look harder at your defences is the witness you should discount first.

The lazy reading of the cheese is to buy another slice. Every slice you add brings another join with it, another supplier and another system that will one day be retired while it still holds your data, and the joins are where both of these stories came apart. Past a point, a taller stack is only more places for the holes to meet.

Who should check the joins, and who should not bother

Act on this if your customers’ information passes through anybody else’s hands, which is to say if you run a business. Your support desk, your payroll bureau, your call centre, your broker and the software house that fixes your system on a Friday afternoon all sit on the far side of a join. Pick the two that would hurt most and ask each to show you, not tell you, what their people are allowed to paste into a ticket and what becomes of it when that platform is retired. Then make the call you hope never to make. Ring the number in your incident clause at the hour you are most likely to need it, and time the answer.

Do not bother if what you want is a signed questionnaire. A questionnaire records what a supplier believes is in its systems, and the MIP story is a supplier finding out otherwise. And do not bother if the plan is to buy another slice, least of all from me, before you know where your joins are.

Kim whispered twenty minutes to herself in the Richtersveld because Race Control had promised it. It was three hours before the paramedics got there. Somewhere in your business there is a twenty minutes that nobody has timed. I would time it before somebody on your side has to whisper it.

Johan de Villiers,
CEO,
First Technology Western Cape