South African data breach tracker.

Breach of the online HR system job seekers use to apply for posts; data stolen and a $100,000 ransom demanded

Unauthorised access to unstructured data in parts of Cell C's IT environment at the end of 2024

Ransomware deployed against selected points in the IT network; parts of the systems, including a backup server, were deleted

LockBit ransomware attack with data exfiltration; access attempt first detected on 16 February 2024

In May 2023, the South African retailer JD Group announced a data breach affecting a number of their online assets including Bradlows, Everyshop, HiFi Corp, Incredible (Connection), Rochester, Russells, and Sleepmasters. The breach exposed over 520k unique customer records including names, email and physical addresses, phone numbers and South African ID numbers.

Unauthorised access to a database built and managed by a third-party operator contracted by Dis-Chem

Access to an isolated South African server through misuse of an authorised client's credentials; the attackers claimed the password was "password"

Ransomware attack on IT systems, including the container terminal operating system

Cyberattack on internal IT systems

In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongst other person information.

Social engineering: the suspect fraudulently requested data from Experian while purporting to represent a legitimate client

Master encryption key printed in unencrypted form at the old Pretoria data centre and allegedly stolen

Network breach followed by a demand for 4 BTC, with a threat to publish stolen data

Unauthorised access to IT infrastructure, including the company's mailing service

In May 2018, the South African website for viewing traffic fines online known as ViewFines suffered a data breach. Over 934k records containing 778k unique email addresses were exposed and included names, phone numbers, government issued IDs and passwords stored in plain text.

In March 2017, a 27GB database backup file named "Master Deeds" was sent to HIBP by a supporter of the project. Upon detailed analysis later that year, the file was found to contain the personal data of tens of millions of living and deceased South African residents. The data included extensive personal attributes such as names, addresses, ethnicities, genders, birth dates, government issued personal identification numbers and 2.2 million email addresses. At the time of publishing, it's alleged the data was sourced from Dracore Data Sciences (Dracore is yet to publicly confirm or deny the data…

In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and plain text passwords.

In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses. Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication. Various methods of customer data enumeration was possible and phishing attacks began appearing the day after launch.