breaches in South Africa (ZA)
Overview On 7 September 2026, the ransomware group The Gentlemen added Hollard Insurance Group to its data leak site. Ho…
Overview On 7 September 2026, the ransomware group tracked as lockbit5 added VSB Attorneys Inc , a South African law fir…
Overview The Direwolf ransomware operation listed Cartrack Holdings , a South African provider of vehicle tracking and f…
Overview The medusalocker ransomware group listed Hungry Lion, a South African fast-food franchise operating 111 locatio…
Overview The incransom ransomware group has listed Rohloff Group, a South African KFC franchise partner, on its leak sit…
Overview The Furniture Bargaining Council (FBC), the South African tariff council for the furniture, mattress and uphols…
Overview On 20 August 2026, the Qilin ransomware group listed Trends And Concepts, a South African interior design and f…
Overview On 19 August 2026, The Gentlemen ransomware group added Babcock Africa to its leak site. Babcock Africa is an e…
Overview The Courier Guy, a South African courier and logistics company operating thecourierguy.co.za, has been listed o…
Overview A DarkForums.as thread posted on 16 August 2026 offers for sale a database that the seller claims was obtained …
Overview Serengeti Estates , the developer behind the Serengeti Golf and Wildlife Estate near Johannesburg, South Africa…
Overview On August 7, 2026, a post on DarkForums.as reported that mpowa.mobi, a South African youth development and empl…
Overview The Krybit ransomware group has listed DC Partner (Pty) Ltd , a South African payment distribution agency (PDA)…
Overview The Krybit ransomware group has listed Buzz Trading 104 (Pty) Ltd , a South African manufacturer and wholesaler…
Overview The Payload ransomware group has listed CKR Consulting Engineers , a Johannesburg-based engineering consultancy…
Overview The Inc Ransom group has listed Reatile Group , a South African investment holding company active in the energy…
Overview The DragonForce ransomware group has listed Isegen South Africa (Pty) Ltd , a chemical company founded in 1974 …
Overview The Arcus Media ransomware group has listed BE Travel , a South African executive travel agency trading as Bait…
Overview On 12 July 2026, the RansomHouse ransomware group listed Fidelity Services Group on its data leak site. Fidelit…
Overview The CMD Organization ransomware group has listed Fidelity Security Group , a South African integrated security …
Overview On 9 June 2026, a DarkForums user posted a document described as restricted and related to the South African ar…
Overview The Stormous ransomware group has listed CGC SA (cgcsa.co.za), a South African company, on its leak site. The l…
Overview The Krybit ransomware group has listed Megasurf , a South African internet service provider and data centre ope…
Overview The DragonForce ransomware group has listed Singita , a South African luxury safari and conservation hospitalit…
Overview On April 2, 2026, a DarkForums user operating as Grubder offered a dataset described as 587,000 customer record…
Overview On 2 April 2026, a DarkForums user offered a dataset described as containing 437,000 records from myschool.co.z…
Overview The Gentlemen ransomware group has listed Sunspray Food Ingredients , a South African manufacturer of spray-dri…
Overview The Inc Ransom group has listed ETFSA , a South African financial services platform specialising in exchange-tr…
Overview The DragonForce ransomware group has listed The Unlimited , a South African insurance provider founded in 1994,…
Overview The NightSpire ransomware group listed Semenya Furumele Consulting Engineers, a South African engineering consu…
Overview The PrinzEugen ransomware group has claimed an attack on Standard Bank Group , one of Africa's largest banking …
Overview The LockBit ransomware group has listed the Diesel-Electric Group , a South African automotive group including …
Overview The Gentlemen ransomware group has listed Intsika Yethu Municipality , an administrative area in the Chris Hani…
Overview The Vect ransomware group has listed EnerTec , a South African manufacturer, on its leak site with a status of …
Overview In February 2026, a DarkForums user named Tanaka, a Global Moderator with GOD award and over 1,200 posts, share…
Overview The Gentlemen ransomware group has listed Rola Motor Group , a South African vehicle dealer group, on its leak …
Overview The Gentlemen ransomware group has listed Witzenberg Municipality , a local municipality in the Cape Winelands …
Overview Hytec, a South African engineering company specializing in hydraulic systems, was listed by the Vect ransomware…
Overview The DragonForce ransomware group has listed the National Credit Regulator (NCR) , the statutory body establishe…
Overview The Qilin ransomware group has listed Diesel Electric , the South African automotive group operating www.de.co.…
Overview The Nightspire ransomware group has listed the Eastern Cape Department of Human Settlements , a provincial gove…
Overview The Clop ransomware group has listed the University of the Witwatersrand (Wits) , a public research university …
Overview The Brotherhood ransomware group has listed Momentum Logistics , a South African logistics company, on its leak…
Overview The LockBit ransomware group has listed Elundini Local Municipality , an administrative area in the Joe Gqabi D…
Overview The Beast ransomware group has listed The Methodist Church of Southern Africa , a Christian denomination with c…
Overview The Inc Ransom group has listed Climatron , a South African HVAC equipment company, on its leak site. The group…
Overview The Black X ransomware group has listed the African National Congress (ANC) , South Africa's governing party, o…
Overview On August 11, 2025, DarkForums user N1KA shared a database breach affecting Body Graphics Tattoo Supply, an onl…
Overview The d4rk4rmy ransomware group has listed Mafate Business Enterprise , a black-owned mining supply company in So…
Overview The Inc Ransom group has listed Netstar , a South African pioneer of stolen vehicle tracking and recovery, on i…
Overview On 19 June 2025, a DarkForums user exposed the NDOH.PERMITS.E2.CO.ZA system, operated for the South African Nat…
Overview The Warlock ransomware group has listed Carducci , a Cape Town-based fashion brand founded in 1978, on its leak…
Overview The Nightspire ransomware group has listed the Ingonyama Trust Board , a South African entity that administers …
Overview The Everest ransomware group has listed Mediclinic Group , a private hospital group based in South Africa with …
Overview The Inc Ransom group has listed South African Airways (SAA) , the state-owned passenger and freight airline, on…
Overview The Devman ransomware group listed Pienaar Brothers, a South African construction company, on its leak site on …
Overview The Devman ransomware group listed dovesit.co.za, a South African IT services domain, on its leak site on 1 May…
Overview The Devman ransomware group listed Premier Meats South Africa, a food company operating at premiermeats.co.za, …
Overview The Arcus Media ransomware group has listed Linkgroup , a South African landscaping and construction company, o…
Overview The Gentlemen ransomware group has listed Paltrack , a South African software solutions provider for the agricu…
Overview The Lynx ransomware group has listed ACDC Express , the South African electrical products retailer and wholesal…
Overview The RansomHub ransomware group has listed the South African Weather Service (SAWS) , the national weather servi…
Overview On 7 February 2025, a DarkForums user posted a dataset described as containing information on 104,035 South Afr…
Overview The APT73 ransomware group has listed Pick n Pay Group Ltd , a major South African retailer operating the Pick …
Overview The Sarcoma ransomware group has listed Baker Tilly Morrison Murray , a firm of registered auditors and charter…
Overview The Akira ransomware group has listed Cipla , the global pharmaceutical company with operations in South Africa…
Overview The DataCarry ransomware group listed FrontierCo, a South African construction company operating at frontierco.…
Overview The KillSec ransomware group listed Sumitomo Rubber South Africa, the local subsidiary of the global tyre manuf…
Overview On 2 October 2024, the RansomHub ransomware group listed Enterprise Outsourcing, a South African technology ser…
Overview The KillSec ransomware group listed OneDayOnly, a South African online shopping platform, on its leak site on 2…
Overview The BianLian ransomware group listed Sable International, a South African company providing citizenship, immigr…
Overview On August 25, 2024, DarkForums user Knox, a Supreme Leader-ranked member, shared the database of eTenders.gov.z…
Overview In August 2024, GMG Mining Machines and Supplies, a South African company specialising in trackless mobile mach…
Overview The DarkVault ransomware group listed the Gauteng Partnership Fund, an agency of the Gauteng Department of Huma…
Overview RansomHub listed NetConfig, a South African IT solutions and services company, on its leak site on 31 July 2024…
Overview The Mad Liberator ransomware group listed the South African Cities Network, an organisation promoting good gove…
Overview RansomHouse listed Sibanye-Stillwater, a major South African mining company and one of the world's largest prod…
Overview The Sarcoma ransomware group listed National Edging, a South African manufacturer of edgebanding products for t…
Overview The BlackSuit ransomware group listed the National Health Laboratory Service (NHLS), South Africa's national di…
Overview On 3 June 2024, the Arcus Media ransomware group listed Botselo Mills on its leak site. Botselo Mills, operatin…
Overview LockBit 3.0 listed ACDC Express, a South African electrical retail and wholesale franchise, on its leak site on…
Overview Kamo Jou Trading, a South African trading company operating kamojou.co.za, was listed by the RansomHub ransomwa…
Overview On 13 April 2024, the Hunters International ransomware group listed Caxton and CTP Publishers and Printers on i…
Overview The RansomHouse group listed Cell C, one of South Africa's largest mobile telecommunications providers, on its …
Overview On 28 March 2024, the BlackBasta ransomware group listed Paterson and Cooke on its leak site. Paterson and Cook…
Overview LockBit 3.0 listed Nampak, the largest diversified packaging manufacturer in Africa, headquartered in Johannesb…
Overview LockBit 3.0 listed the Government Pensions Administration Agency (GPAA), the South African body that administer…
Overview The DragonForce ransomware group listed ERWAT, the East Rand Water Care Company and a major South African waste…
Overview LockBit 3.0 listed The Aurum Institute, a South African healthcare and research organisation, on its leak site …
Overview The Monti ransomware group listed Smith Capital Equipment, a South African company operating at smithcapital.co…
Overview LockBit 3.0 listed Crowe South Africa, the local member firm of the Crowe global accounting and consulting netw…
Overview The LockBit 3.0 ransomware group listed Tiger Wheel & Tyre, a South African retailer of wheels, tyres and batte…
Overview LockBit 3.0 added TiAuto Investments, the South African holding company behind retail automotive brands includi…
Overview Tshwane University of Technology (TUT), one of South Africa's largest higher education institutions, was listed…
Overview In November 2023, a DarkForums.as member reposted a database linked to the May 2023 data breach at JD Group, th…
Overview On 16 October 2023, a DarkForums.as member posted data described as a leak of South African government records,…
Overview A dataset labelled HostAfrica.co.za leak was posted on DarkForums.as on 10 September 2023 by the user Tanaka. H…
Overview A CSV file labelled Jdgroup.co.za was posted on DarkForums.as on 11 June 2023 by the user Tanaka. The 100 MB fi…
Overview A post on DarkForums.as published on 8 April 2023 shared data attributed to Atlas Security, an armed response c…