Your private bank statements, home loan agreements, municipal payroll records and even school files could be up for sale on the dark web, where stolen SA data is being traded for thousands of rand, with one batch of 453,362 job seekers’ records advertised for about R34,000.The Gentlemen hacking group is offering data stolen from a Toyota dealership in Mpumalanga to interested buyers, while rival syndicate LockBit has gone a step further, posting a law firm’s confidential client documents online for anyone to download.The stolen information is not limited to businesses, an IOL investigation revealed.Grey High School in Gqeberha, Elundini Local Municipality in the Eastern Cape, VSB Attorneys, Statistics SA and the ANC are also among the SA organisations whose data has surfaced on leak sites over the past year.The Information Regulator has received more than 8,000 breach notifications to date, while a former detective who advised police on their cybercrime strategy said the country did not have enough skilled investigators to track down those behind the attacks.IOL trawled the dark web sites where ransomware syndicates post their victims, and found the private records of ordinary South Africans laid out for anyone to take.Some of it could be downloaded free with a few clicks, while the rest came with a price tag and an invitation to make contact.The most recent SA victim is Lydenburg Toyota, in Mashishing, formerly Lydenburg, which The Gentlemen listed on its leak site about a fortnight ago.The listing carried a note telling anyone who wanted the dealership’s data to contact the syndicate to buy it.Check Point Research, the threat intelligence arm of cybersecurity company Check Point, has ranked The Gentlemen the second most active ransomware syndicate in the world this year by number of victims, less than two years after it first surfaced.Refilwe Ramatlhodi-Ndhlovu, corporate communications manager at Toyota SA Motors, or TSAM, said the company was aware of a ransomware-related event at the dealership, and that the dealership had alerted TSAM and launched an investigation.“As investigations are ongoing, neither Lydenburg Toyota nor TSAM can comment further on the matter,” Ramatlhodi-Ndhlovu told IOL when approached for comment.“Notwithstanding this, TSAM recognises the trust that customers place in the brand and its nationwide dealer network.”She said it had cybersecurity measures in place across its dealerships and was working with Lydenburg Toyota to investigate the breach, strengthen security and protect customer information.LockBit, one of the world’s most infamous ransomware syndicates, has listed four SA organisations on its leak site since December last year.The first was Elundini Local Municipality, based in Nqanqarhu, formerly Maclear, which LockBit listed on December 6 last year.Folder dates in the leaked material suggest the municipality’s files were copied from its systems on or around October 17, 2025, about seven weeks before the syndicate named it.The folders appear to hold payroll system files, databases and server files, along with documents on agricultural projects and commonage land, internal memos and residents’ personal documents.The files also contained Hollywood movies that an employee had seemingly downloaded illegally.The municipality did not respond to questions sent on Tuesday about when it learnt of the attack, whether a ransom was demanded and whether residents or staff had been told.LockBit listed Grey High School on June 17.The leaked documents appear to include pupils’ birth certificates, their parents’ identity documents, home addresses, class lists and letters from the Eastern Cape education department about pupils’ learning support.IOL will not publish any of the personal information contained in the documents.Mark Groch, chair of the school’s governing body, said the school was hit by a criminal ransomware attack on its IT systems in April, acted on the advice of outside specialists, notified the relevant authorities and kept parents updated in writing, most recently on October 30.“The school will not confirm, enumerate or comment on individual records or categories of confidential information,” Groch told IOL.“Cybercrime is a growing threat to SA institutions, and no organisation is entirely immune.”LockBit listed VSB Attorneys on September 7, and gave the law firm until September 22 to pay before it published the files.The published files appear to include clients’ proof of payment documents, bank statements, deeds records, home loan agreements, property sale agreements, contracts and identity documents.A security notice on the firm’s website, last updated on October 22, said the matter had been brought to the attention of the relevant authorities.The 453,362 job seekers’ records come from Stats SA, which confirmed in March that its online job application system had been breached and said it had notified the Information Regulator.A group called XP95 claimed the attack at the time and demanded $100,000, about R1.7m, to keep 154GB of data off the internet.An archive of the same size is now listed for $2,000 on Kazu, a dark web site with its own ransom and leak sections.A sample of the leaked files seen by IOL contained job applicants’ CVs, copies of their identity documents and certified qualifications.In June, a group called Black X listed the ANC on its leak site, saying it had taken the party’s membership data in August last year.How ransomware groups operateCraig Rosewarne, managing director of Wolfpack Information Risk, said the syndicates usually got in through one computer and then worked their way through the rest of the network.“Once they do gain access, maybe through one machine, they use that as a foothold and then they will escalate and scan the environment and find what is worth pillaging,” Rosewarne said.“Generally the modus operandi is they copy, exfiltrate, steal the information from systems, and then they encrypt the systems and they come back and they demand a ransom.”Rosewarne said schools, small firms and municipalities were easy targets because they did not have the money or the staff to defend themselves, and attackers were now using artificial intelligence to scout their victims.“Schools, smaller firms, municipalities, they’re attractive targets because they generally don’t have the budgets that medium to large organisations have, and that includes the teams and the systems,” Rosewarne said.“There’s generally one person that’s kind of doing a bit of security, or it’s outsourced to an IT company.“They’re running on bare bones, and of course, you can’t expect them to withstand attacks from a criminal syndicate or even a skilled individual.”He said the syndicates ran their extortion as a business, and helped victims who chose to pay.“You can negotiate with them, bring down the actual fee, and they would go out of their way to give you really good customer service to show you how you can go about paying using Bitcoin,” Rosewarne said.“It’s not their first rodeo, so they know what they’re doing.”Rosewarne said stolen data was sold in bulk to fraudsters running romance, job and investment scams, and some of it ended up in the hands of ordinary businesses.“This just gets sold to even legitimate companies in SA to try and bolster their marketing and sales capabilities,” Rosewarne said.“You can change your username, your password, your email address, but you typically can’t change things like your ID number.”He said not every claim on a leak site was what it seemed, and his firm had recently seen two cases where the sample records a hacker posted did not belong to the organisation named.The scale of South Africa’s breach problemAndrew Henwood, founder of digital forensics firm BlckRhino, explained to IOL most attackers did not need to exploit technical vulnerabilities to gain access to a system.“They are ‘logging in’ rather than ‘hacking in’, using a stolen password, a phished employee or a remote-access account without multi-factor authentication,” Henwood said.“Schools, law firms, municipalities and dealerships often have no MFA, unpatched systems, untested backups and nobody watching for intrusions, yet they hold extremely valuable personal data.”Henwood said an ID copy, a payslip and a bank statement together gave a fraudster everything needed to open accounts, apply for credit, swap a victim’s SIM card or pose as a parent.“That combination is effectively a complete identity kit,” Henwood said.“Children’s identities are especially attractive because misuse can go unnoticed for years.”He said a cheap price tag made stolen data more dangerous, not less, and that criminals often used it years later, when victims had stopped being on guard.“Once sensitive data has been exposed, it’s in the open for good,” Henwood said.“A low asking price simply means more criminals can afford it.”Henwood said paying a ransom did nothing for the people whose information had been taken, and that British police found, when they took down LockBit’s systems in 2024, that the syndicate had kept data belonging to victims who had paid.“Paying does not protect the people whose data was taken,” Henwood said.“You are buying an unverifiable promise from a criminal.”He said the duty to report a breach kicked in when an organisation had reasonable grounds to believe someone had got into its systems, not once it had proved it, and that even one hacked staff inbox holding ID copies or payslips should be reported.“In our experience, a significant number of organisations ‘take the risk’ and don’t report,” Henwood said.“Organisations often get away with staying quiet, while their victims bear the consequences.”Henwood urged anyone whose data might have been exposed to be wary of unexpected requests for payment or new bank details, to check them by phoning a number they already had, and to never share OTPs or passwords.Jason Jordaan, principal forensic scientist at DFIRLABS, said the law itself was not the obstacle to effective investigations.“The most significant challenge facing cybercrime investigations in SA is not necessarily a lack of legislative authority or investigative powers,” Jordaan, a former SAPS sleuth told IOL.“Rather, it is the shortage of suitably qualified, appropriately trained, and genuinely competent investigators within our law enforcement agencies.“Legislation can provide law enforcement with the authority to investigate cybercrime, but legislation alone cannot create investigative capability.”The Information Regulator told a media briefing on August 31 that 1,220 of its breach notifications had come in since April 1, and that it expected more than 3,000 by the end of the financial year.Regulator chairperson Pansy Tlakula described the rate as alarming, and the regulator said some organisations did not report compromises at all, so the real figure was likely higher.The regulator’s website said a breach did not have to be confirmed before it was reported.One of the first convictions under the Cybercrimes Act came in June last year, when the Bellville Specialised Commercial Crimes Court sentenced Lucky Majangandile Erasmus, 36, a former employee of Ecentric Payment Systems, to eight years in prison, three of them suspended.The Hawks, the police’s priority crimes unit, said Erasmus and his co-accused, Felix Unathi Pupu, installed software on Ecentric’s systems in late 2023 that gave them remote access.On November 14, 2023, a person contacted Ecentric’s chief executive and demanded $534,260 within 16 hours, threatening to publish the company’s data, the Hawks said.Ecentric did not pay, but four of its retail clients lost R794,808.51, the Hawks said.Erasmus was convicted on 17 of 20 charges, including cyber fraud, theft of data and attempted cyber extortion, after a plea and sentence agreement with the state.IOL’s own research on leak-site trackers found more than 34,000 postings by ransomware syndicates worldwide, by 744 groups, 86 of which were still active.Dominic White’s team at cybersecurity company Orange Cyberdefense said in written answers to IOL that 7,515 victims had been listed publicly around the world by September this year, more than the 7,097 listed in the whole of 2025.The team said 151 ransomware groups were active by September, up from 33 in 2020, and that SA was usually one of the three most affected countries in Africa.“Our data may not necessarily be more valuable, but we have systems that are connected to the internet that can be breached,” the team said.“A listing should remain an unverified allegation unless independently corroborated.”The team said the true number of victims could be 50% higher than the leak sites showed, because victims who paid might never be listed, though the share who paid during negotiations fell from 50% to below 21% in 2025.It said syndicates did not pick schools and small organisations for big payouts, but because they were easy to get into, cheap to attack and there were many of them.The team called for ransomware reporting to be made compulsory, so the true scale of the problem was known and police could measure whether they were making a dent.“Cyber extortion is first about extortion, and then about cyber,” the team said.“It’s a crime against people, facilitated by computer systems.”IOL
Click Here For The Original Source.
——————————————————–
