South African Credit Bureaus Under Siege as Hackers Demand $60 Million

Recent reports indicate that TransUnion and Experian, two of the largest consumer credit reporting agencies in South Africa, may be grappling with a new data breach, putting the financial and personal information of South African citizens at risk.

The hackers, identified as the Brazil-based N4ughtySecTU Group, previously responsible for breaching TransUnion, reportedly managed to bypass the organizations’ firewalls and security measures once again, gaining unauthorized access to sensitive data.

The hackers revealed journalist Sabelo Skiti’s name and identity number through his personal WhatsApp account. The N4aughtySec Group then issued a ransom demand, stating that they were inside the organizations’ infrastructure and threatening to expose all data and system files within 24 hours unless a $30 million ransom from both TransUnion and Experian was paid.

TransUnion, responding through its PR company, confirmed the demand but emphasized that, as of now, there is no evidence of inappropriate access to their systems or the exfiltration of any data. They reiterated their commitment to information security, asserting that data security remains their top priority.

Experian, on the other hand, stated that they had investigated the claims of illegal data acquisition and found them to be baseless. They asserted that there is no evidence of compromise to their systems or data, as well as that of their clients, reiterating their commitment to reviewing and enhancing security measures.

While the hackers have not provided evidence of a new breach or the extraction of new data, cybersecurity experts warn that if proven true, these claims raise questions about the effectiveness of measures taken by these institutions to curb cyber intrusions. Karim Jaber, CEO of the cybersecurity firm Scarybyte, emphasized the need for regulatory bodies to ensure the efficacy of security upgrades implemented by companies, especially when dealing with sensitive data.

This potential breach follows a previous attack in 2022, where N4aughtySec threatened to leak sensitive credit information unless a ransom was paid. TransUnion, at that time, believed the attack was linked to a 2017 hacking of an SA government website, affecting millions of consumers.

The Information Regulator had previously ordered TransUnion to publicize details of the information hackers stole. This recent incident underscores the ongoing challenges faced by organizations in safeguarding sensitive data and the potential implications for individuals and businesses alike.

We will update this article when we have more information.