Ingonyama Trust Board listed by the Nightspire ransomware group

Overview

The Nightspire ransomware group has listed the Ingonyama Trust Board, a South African entity that administers land held in trust for communities in KwaZulu-Natal, on its leak site. The listing appeared on 1 June 2025.

What was published

The group has listed the board as a victim but has not published detailed data descriptions at this stage. The board holds land administration records, beneficiary data and employee information, which are the likely contents of any exfiltration.

Risks for affected individuals

• Land beneficiaries' personal data may be exposed.
• Administrative records could enable fraud.
• Employees' information may be included.

What remains unknown

• Whether data has been exfiltrated.
• The volume of records involved.
• The timeline of any release.

What affected people should do

The board should coordinate with South African authorities, review affected systems, and inform beneficiaries and staff. Beneficiaries should be alert to phishing referencing the board.