Statistics South Africa (Stats SA) has been targeted in a ransomware attack, with hackers claiming to have stolen more than 450,000 files from its systems, in one of the most significant recent cyber incidents involving a South African government agency.
The breach affected a human resources database used for job applications, raising concerns about the security of personal information submitted through the agency’s e-recruitment platform.
Statistician-General Risenga Maluleke confirmed that the compromised data is linked to human resources records. “What was taken from us were more files that relate to HR information; we have an e-recruitment facility, which people can access online from anywhere,” he said.
The XP95 ransomware group has claimed responsibility and is demanding payment, setting a deadline of April 20, state broadcaster SABC reports.
‘Breach through applications platforms’
Maluleke explained the breach could have entered Stats SA systems through facilities or platforms job applicants had used. “They could have been using an internet cafe; they could’ve been using their phones, which may not be protected – and in this regard, it’s their information. So, it’s more like identity theft that is more at risk.”
Stats SA said it is working with authorities and will notify the information regulator as investigations continue.
Statistics South Africa is the country’s official data agency, responsible for producing demographic, economic and social statistics used to guide policymaking and economic planning.
The attack adds to a list of ransomware incidents affecting government-linked institutions in South Africa.
On August 12, 2022, the South African Reserve Bank (SARB) — the country's apex bank and financial regulator — suffered a cyberattack by unknown hackers.
In September 2021, the Department of Justice and Constitutional Development was hit by a ransomware attack that encrypted all electronic systems and disrupted court operations, with about 1,200 personal files compromised.
Earlier that year, on July 22, 2021, state-owned logistics company Transnet suffered a ransomware attack that shut down port and rail systems nationwide. While the incident caused widespread disruption to critical infrastructure, officials said no customer data was stolen or compromised.
