Megasurf listed by the Krybit ransomware group

Overview

The Krybit ransomware group has listed Megasurf, a South African internet service provider and data centre operator, on its leak site. The company provides high-speed fibre and wireless internet services. The listing appeared on 8 April 2026.

What was published

The group claims to have exfiltrated data from the ISP. The archive is expected to include subscriber records, network configuration data and corporate information. The full dataset has not been released publicly at this stage.

Risks for affected individuals

• Subscriber personal data may be exposed.
• Network records could reveal infrastructure details.
• Employees' information may be included.

What remains unknown

• The volume of records involved.
• Whether the data has been published.
• The extent of the intrusion.

What affected people should do

Subscribers should be alert to phishing messages and monitor account activity. Megasurf should review affected systems, notify customers and regulators if subscriber data is involved, and communicate transparently about the incident.