The Attacks You’ll Actually See

An external direct-marketing contractor handling SMS/email campaigns on Nedbank’s behalf was breached. Nedbank’s own core banking systems were never touched.

Impact

~1.7 million customers (1.1 million active, ~600,000 former) had personal details exposed.

Takeaway

The bank’s own security was fine. The vendor’s wasn’t — and customers were exposed anyway.

Dis-Chem’s third-party e-statement provider was hit by a brute-force attack — attackers simply guessed weak, poorly-protected database passwords. Dis-Chem notified the Information Regulator within days of discovering it, but South Africa’s Information Regulator later found the security measures at the vendor were inadequate and that no proper data-handling agreement was in place between Dis-Chem and that vendor.

Impact

~3.6 million customer records (names, emails, cellphone numbers) exposed.

Takeaway

Notifying people quickly is the right move — but it doesn’t undo the obligation to make sure a vendor is actually secure before handing them your customers’ data.

Attackers used a stolen, valid login belonging to an authorised business client — reportedly secured with nothing stronger than the password “Password” and no second factor — to access an isolated database and demand a multi-million-dollar ransom.

Impact

TransUnion confirmed at least three million South Africans had data exposed. The attackers separately claimed far higher numbers (tens of millions of records), which TransUnion disputed and were never independently confirmed.

Takeaway

One weak password on one account, with no MFA behind it, was the entire attack.

Ransomware encrypted the department’s systems nationwide, disrupting bail services, deceased-estate processing, court records, and child maintenance payments. The department had let its antivirus and intrusion-detection software licences lapse.

Impact

In July 2023, the Information Regulator issued its first-ever POPIA fine — R5 million — specifically for failing to keep basic security software active.

Takeaway

An expired software licence, left unrenewed, became a national outage and a landmark fine.

South Africa’s second-largest private hospital operator was hit by ransomware and took its entire network offline to contain it — forcing staff across the group back to pen and paper for admissions, billing, and clinical notes, during COVID-19.

Impact

66 hospitals across South Africa and Botswana affected; systems substantially restored within about a month.

Takeaway

Even an organisation that can fall back to paper still pays a heavy price — the attack didn’t stop patient care, but it stopped nearly everything else.

Ransomware forced South Africa’s state logistics operator to take its container-terminal systems offline and declare force majeure at every major port.

Impact

Durban, Cape Town, Port Elizabeth and Ngqura ports frozen for about a week; Durban alone handles roughly 60% of the country’s container traffic.

Takeaway

Ransomware doesn’t have to touch your money to cost you money — it froze an entire country’s shipping for a week.

A criminal syndicate performed unauthorised SIM swaps on business owners’ phone numbers, intercepting the one-time PINs meant to protect their banking, and drained funds from online business accounts. It took years of investigation before six suspects were arrested.

Impact

Over R18 million stolen.

Takeaway

The fraud itself happened in 2021–2022 — the arrests only came three years later. The financial damage is immediate; justice, if it comes at all, is not.