Archive photo for illustration purposes only. (Photo: Markus Winkler/Unsplash)
A cyber crime group infiltrated one of Statistics South Africa’s (StatsSA) databases and stole 154 GB of data. A total of 453,362 data files were stolen.
The cyber crime group called XP95 is now demanding a ransom of $100 000 (or R1.7 million) from StatsSA or the stolen data will be leaked to the public. The institution apparently has until April 20 to make the payment.
However, StatsSA has no intention of paying the ransom.
Semakaleng Thulare, acting deputy director-general of statistical support and informatics at the institution, told Maroela Media on Monday that StatsSA is regulated by the Public Financial Management Act.
“We are therefore limited by legislation to, for example, pay a ransom.”
StatsSA is indeed aware of a cyber security breach, Thulare confirmed on Monday.
According to Thulare, only one database – the agency’s human resources database – was affected by the cyber security breach.
“The system that was infiltrated was exclusively the human resources system available for job seekers to apply online,” Thulare explained. “The Office for National Statistics is part of a wider government response to cases relating to cyber security breaches.”
Thulare says StatsSA will therefore notify the information regulator and be guided through their processes.
This is the second time this month that the XP95 cybercrime group has targeted a government entity.
The group also infiltrated the Gauteng provincial government’s systems earlier this month. The group then stole 3.8 TB of people’s personal data on the provincial government’s servers and offered it for sale at R400 000.
However, VECERT Analyzer, a cyber threat intelligence platform, says the latest attack compromises the integrity of the country’s central database of census, economic and social indicators.
???? Data Theft at Statistics South Africa (Stats SA) ????????????
Analyzer has detected a new mass extortion operation carried out by the XP95 actor, this time targeting Statistics South Africa, the country’s national statistics agency. The attack compromises the integrity of the… pic.twitter.com/vIVAtbWMiU
— VECERT Analyzer (@VECERTRadar) March 29, 2026