South African Weather Service (SAWS) listed by the RansomHub ransomware group

Overview

The RansomHub ransomware group has listed the South African Weather Service (SAWS), the national weather service of South Africa, on its leak site. The service provides forecasts, warnings and observations across the country. The listing appeared on 12 February 2025. At the time of analysis, the group's leak page was not reachable.

What was published

The group claims to have exfiltrated data from the weather service. The archive is expected to include meteorological records, administrative documentation and employee information.

Risks for affected individuals

• Employees' personal records may be exposed.
• Operational data could be misused.
• Administrative information may be sensitive.

What remains unknown

• The volume of data exfiltrated.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

The service should coordinate with South African cybersecurity authorities, review affected systems, and inform staff. Employees should be alert to phishing referencing the weather service.