Managing third-party risk with underwriter agnostic solutions

Beyond the policy: Managing funeral policy data and the risk that sits below the insurer.

By Chris Ogden, CEO, RubiBlue

Regulators have said insurers carry the liability for a breach, but the harder question, says Chris Ogden, CEO of RubiBlue, is who controls the data further down the chain and what that means for the funeral parlours.

South Africa’s funeral insurance market runs on volume and trust. Life insurers wrote 6.2 million new funeral policies in 2025, more than half of the 10.8 million new individual recurring premium risk policies sold that year.

Many of these policies are sold by a funeral parlour, administrator or binder holder that built the relationship one family at a time and who spent time establishing trust. And this chain of trust came under pressure in 2026 when attackers accessed data held by a software supplier serving around 45 South African insurers.

The attackers tool around 400,000 records belonging to customers from 45 client organisations from a support platform in an incident that was discovered in June. The information included policy numbers linked to identity numbers and among those affected was a binder holder administering around 6,000 funeral policies.

While the breach compromised personal identity information at scale, it also shone a spotlight on how companies in a similar position would be impacted by the Information Regulator and the Protection of Personal Information Act (POPIA). The regulatory responsibility remained with the insurer – the Information Regulator said the relevant POPIA obligation rests with the responsible party while the Prudential Authority said that insurers must address incidents originating at service providers and report those classified as material within 24 hours. The incident also drew a thick red line under the question of concentration risk across shared suppliers – how should this be treated when one supplier serves a large share of the sector?

Concentration risk is usually measured at the insurer level and that view is reasonably clear. The Prudential Authority collects and analyses information on material outsourcing arrangements each year to identify exactly this kind of exposure. This establishes a supervisory view of supplier dependencies but doesn’t tell an individual funeral parlour what assurance it has over the systems holding its customers’ information. Far less visible is the layer underneath where funeral parlours, administrators and binder holders often run their policy books on systems they neither own nor control. In many cases, those systems are supplied by the underwriter or administrator the parlour sells for.

The key message here is to revisit the core principles of security and control. A parlour with a book living in a system it cannot inspect has to take that system’s security on trust. It has no view of how support staff handle the data or what sits in a test environment or which extracts are stored where. When something goes wrong, notice travels down the chain, one link at a time, from the operator to the insurer, and only then to the policyholder. The parlour is often the first number a worried family calls but may be the last to know.

A business that cannot readily retrieve a complete copy of its own book cannot easily recover from an incident or switch providers or check what it holds. And this leaves parlours and administrators with several decisions to make. The first is to know where the data travels because the core admin system is only part of the picture. Support tools, test environments, reporting extracts and SMS campaign files all carry personal information. The breach this year came through a support platform rather than a core admin system.

The second step is to test whether the business can get a complete and usable copy of its policy book within days and treat that test with the same seriousness as a disaster recovery plan. Third, notification duties need to run all the way down the chain. Joint Standard 2 of 2024 requires material incidents to be reported to the Regulator within 24 hours so contracts between insurers, binder holders, administrators and parlours should set the same clarity for every party whose clients are affected. Finally, it’s worth asking whether whoever holds the data has a commercial interest with the clients inside it and how any conflict is disclosed and managed.

Insurers already report material outsourcing, so mapping risk beyond the first tier would close much of the gap. Extend reporting to cover which systems binder holders and intermediaries use, who controls those systems, and whether the companies that rely on them can export their own records. Data portability belongs inside access controls and patching as part of operational resilience and a system can be well secured and still concentrate risk if it is difficult to leave.

Funeral cover in South Africa rests on monthly premiums paid to businesses that families know personally. As security and governance requirements continue to tighten, those businesses need to be able to see, protect and retrieve the records that represent that trust. The most practical starting point is to ask where the policy book sits today, who holds the keys and how quickly it can be brought home.