Statistics South Africa Hit by XP95 Ransomware Attack Targeting HR Database
Learn More
Statistics South Africa (Stats SA), the national statistics agency, confirmed a ransomware attack targeting its human resources infrastructure in March 2026. The incident, claimed by the XP95 group, impacted the agency's e-recruitment platform used by job seekers.
The compromised data includes:
- Full names and identity numbers
- Contact information and home addresses
- Employment history and educational records
- Digital copies of identity documents and certifications
- Internal HR administrative files
The threat actors claim to have stolen 453,362 files totaling 154 GB of data and demanded a ransom of $100,000 with a payment deadline of April 20, 2026. Stats SA stated it will not pay the ransom, citing compliance with the Public Finance Management Act (PFMA). The agency isolated the affected HR database and is working with the National Cyber Security Directorate and the Information Regulator to manage the fallout.
