Millions of South Africans’ data is being held to ransom

Credit reporting agency TransUnion South Africa has been hacked, with the hackers claiming they have accessed 54 million personal records of South Africans.

In a statement on Thursday, TransUnion SA said its server was accessed by a “criminal third party” through the misuse of an authorised client’s credentials.

The hackers reportedly gained access to four terabytes of data and are demanding a ransom of $15 million (about R223 million).

The hackers, N4aughtysecTU, claim to be from Brazil.

TransUnion South Africa is the local division of the USbased consumer credit bureau.

It says it will not give in to the hackers’ demands.

“We have received an extortion demand and it will not be paid,” the agency said in a statement.

According to MyBroadband, the leaked data may include client’s contact information, such as telephone numbers, e-mail addresses, identity numbers and physical addresses.

“The security and protection of the information we hold is TransUnion’s top priority,” said Lee Naik, chief executive of TransUnion South Africa.

“We understand that situations like this can be unsettling and TransUnion South Africa remains committed to assisting anyone whose information may have been affected.”

In a tweet, technology expert Nafisa Akabor claimed the agency, which holds the data of millions of South Africans, used “Password” as its password.

She said the data breach is bigger than the one that occurred at credit bureau Experian in August 2020.

In September 2021, the Directorate for Priority Crime Investigation (Hawks) arrested a 36-year-old suspect in Gauteng following the massive Experian data breach.

At the time, Hawks spokesperson Colonel Katlego Mogale said Experian allegedly entered into a contract with the suspect, who posed as a director of Talis Holdings, requesting services from them.

This gave the suspect access to the personal information of millions of people.

“The suspect then proceeded to download approximately 23 million personal data records and 727 000 business records.

The suspect then attempted to sell these records at about R4.2 million,” Mogale said.

Manie van Schalkwyk, CEO of the Southern African Fraud Prevention Service, said the data breach is proof that every company that holds personal information is a target.

“The consumer desperately needs an extra layer of protection on their identity against criminals who will turn their lives upside down without a second thought,” he said.

An estimated 17 billion cyberattacks take place around the world every day. Not all are successful, though.