South African Data Leak Crisis: ID Documents, Bank Statements and Children’s Records Exposed

Personal information belonging to South Africans has increasingly appeared on websites operated by ransomware groups, with exposed records reportedly including identity documents, bank statements, employment details and school records.

The latest organisation identified is Lydenburg Toyota, a dealership in Mashishing, Mpumalanga.

The hacking group The Gentlemen listed the dealership on its data leak website on 31 October, inviting potential buyers to contact the group about obtaining the stolen information.

Toyota SA Motors confirmed that the dealership had experienced a ransomware-related incident and said an investigation was under way.

Schools, Municipalities and Government Organisations Also Affected

Other South African organisations whose information has appeared on ransomware leak websites over the past year include Grey High School in Gqeberha, Elundini Local Municipality in the Eastern Cape, VSB Attorneys and Statistics South Africa.

One of the incidents involved the theft of 453,362 job seekers’ records from Stats SA’s online job application system.

The attackers initially demanded $100,000, approximately R1.65 million, to prevent the information from being published. The same collection of records is now reportedly being advertised for around $2,000, equivalent to approximately R33,000.

However, cybersecurity company Orange Cyberdefense has cautioned that an organisation appearing on a ransomware leak website does not automatically establish that a breach has been independently confirmed. Such claims should be treated as allegations until they are verified through other sources.

Information Regulator Reports More Than 8,000 Breach Notifications

The Information Regulator has received more than 8,000 data breach notifications to date.

Between 1 April and 31 August 2026, the regulator received 1,220 notifications and projected that the total could exceed 3,000 during the financial year.

At a media briefing on 31 August, regulator chairperson Pansy Tlakula described the reported breach rate as “very alarming”.

The regulator also indicated that the actual number of incidents could be higher because some organisations do not report breaches.

According to the regulator, human error accounts for most reported data breaches, rather than deliberate cyberattacks.

Stolen Records Can Be Used for Identity Fraud

Information reportedly exposed in data leaks includes copies of identity documents, bank statements, home loan agreements, payroll records, CVs, academic qualifications, children’s birth certificates and school records.

Andrew Henwood, founder of digital forensics company BlckRhino, warned that combining several types of personal information could allow criminals to impersonate individuals and commit financial fraud.

He explained that an identity document, payslip and bank statement could provide enough information for criminals to open accounts, apply for credit, carry out SIM swaps or impersonate a parent.

Henwood described the combination as a complete identity kit.

He also warned that stolen information may be used years after an initial breach, when victims may no longer be monitoring the possibility of fraud.

Children’s personal information is particularly attractive to criminals because fraudulent activity involving their identities may remain undetected for extended periods.

How South Africans Can Check Whether Their Information Has Been Exposed

Individuals can take several steps to identify possible exposure and monitor for suspicious activity.

One option is to enter an email address on Have I Been Pwned, a free online service that identifies whether an address has appeared in known data breaches.

Consumers are also encouraged to check their credit reports for unfamiliar accounts or credit applications. Under the National Credit Act, individuals are entitled to one free credit report each year from each credit bureau.

Regularly reviewing bank statements can help identify unusual transactions, including small payments that may indicate unauthorised activity.

Other warning signs include unexpected one-time passwords, messages requesting personal information and payment instructions directing customers to unfamiliar bank accounts.

Steps to Take if Personal Information Has Been Exposed

People who suspect their information has been compromised are advised to change their passwords, beginning with email accounts and banking applications.

Different passwords should be used for separate accounts, while two-step verification or multi-factor authentication should be activated wherever available.

Banking customers should never disclose their PINs or one-time passwords to anyone, including individuals claiming to represent financial institutions.

Unexpected payment requests should also be verified by contacting the relevant company through a telephone number already known to the customer rather than using contact details supplied in the suspicious message.

Another recommended measure is applying for free Protective Registration through the Southern African Fraud Prevention Service (SAFPS).

The service alerts participating organisations, including banks and retailers, to take additional precautions when processing applications for accounts in a registered person’s name. Online applications require a smartphone.

Anyone whose identity document has been used fraudulently should notify their bank, report the incident at a police station and inform SAFPS.

What POPIA Requires Companies to Do

The Protection of Personal Information Act (POPIA) requires organisations to take reasonable steps to safeguard personal information.

Companies must notify the Information Regulator and affected individuals when there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

Paying a ransom does not guarantee that stolen information will be deleted or that affected individuals will be protected.

Henwood warned that organisations making ransom payments were relying on promises from criminals that could not be independently verified.

Consumers who believe an organisation has mishandled their personal information can submit a complaint to the Information Regulator.

The regulator can be contacted through its toll-free number, 080 001 7160.