Rand Mutual Assurance says it is investigating after a ransomware crew claimed it had taken hundreds of gigabytes of workers' compensation claim records. The insurer has not confirmed that data left its systems, and the demand itself is unverified.

What happened

The Kazu ransomware group listed Rand Mutual Assurance (RMA) on its leak site and claims it holds 366GB of data, including more than 1.6 million claim records and almost 600 000 files, MyBroadband reported on 23 October 2026. The group says it demanded $98 000, about R1.57 million, and will publish the data if it is not paid by 4 November 2026.

RMA's chief information security officer, Nduduzo Majozi, told TechCentral that the company has received an alert about a data breach and that investigations are under way. That statement does not confirm that data was taken, and it does not address the ransom demand.

Everything about scale here comes from the attacker. Record counts are also not people counts: one worker can generate many claim records across years, which is the same caveat Ampath raised about its own breach figures this month.

Who is affected

RMA was founded in 1894 and administers compensation for the mining industry and, since 2015, for iron, steel and metal employers under the Compensation for Occupational Injuries and Diseases Act. Those employers register with RMA rather than with the state Compensation Fund.

• Mining, iron, steel and metal employers whose staff claims are administered by RMA.
• Injured workers and their families, whose claim files can hold ID numbers, medical reports on an injury or illness, and bank details used for payment.
• Brokers, benefit consultants and claims or payroll administrators holding extracts of the same records.

What to do now

Treat this as an unconfirmed breach and check your own exposure now, rather than waiting for RMA's findings. As an RMA-registered employer you remain the responsible party for personal information you hold yourself, and claims data is health data.

• Ask RMA in writing which data categories and date ranges are in scope, and whether your employees' claim records sat in the affected systems.
• Confirm you can produce a list of affected staff quickly, from your own claim and injury records, if a notification arrives.
• Review who can reach claims exports and shared drives, and revoke access for anyone who has left.
• Brief HR and payroll about follow-on phishing that quotes claim numbers, ID numbers or medical detail.
• Record decisions and dates: Section 22 of POPIA requires notification to the Information Regulator and to affected people as soon as reasonably possible once there are reasonable grounds to believe personal information was accessed.

What this means for South African businesses

This lands in the middle of a bad run for South African insurance and healthcare data, after the Ampath pathology breach and the MIP Holdings incident that reached LegalWise and Samwumed through a shared software supplier.

The pattern worth noting is that the named victim is rarely where the copies live. An SME's exposure usually sits with the administrator, broker or bureau that holds the same claim files and never appears on a leak site.

My judgement: most small employers will treat this as RMA's problem, and that assumption is precisely what makes the second wave of these attacks pay.

Source: MyBroadband.