NetOne listed by the hunters ransomware group

Overview

In July 2024, the Hunters International ransomware group added NetOne, the state-owned mobile telecommunications operator of Zimbabwe, to its data leak site. The listing indicated that data was exfiltrated and that systems were encrypted. NetOne is one of the largest mobile networks in Zimbabwe by subscriber base.

What was published

The Hunters International listing for NetOne confirmed exfiltration and encryption but did not publish a record count or a detailed inventory of the stolen data. In other Hunters International cases, exfiltrated material has included customer databases, billing records and internal corporate documents. No public sample of the NetOne data was observed.

Risks for affected individuals

NetOne subscribers could be affected if customer records, call detail records or billing information were among the stolen files. Such data enables targeted phishing, SIM-related fraud and identity theft. Corporate documents could expose internal operations and employee information.

What remains unknown

The scale of the data set, the specific fields exposed, and whether the group released any portion of the data after the initial listing are not confirmed. NetOne has not published a detailed incident report, and the listing did not include a deadline or price.

What affected people should do

Subscribers should reset passwords used with NetOne accounts, enable two-factor authentication where available, and treat messages that reference account details with caution. Organisations that work with NetOne should review their contracts and data-sharing practices while awaiting official confirmation.