Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000
Leak-site pricing shows what stolen South African identity documents and CVs are worth

Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000

Stolen South African records are being dumped and discounted on ransomware leak sites, and the asking prices show how little a working identity document is worth to a buyer. An archive of 453,362 job-seeker records taken from Statistics SA is now listed at about $2,000, roughly R34,000, against a $100,000 demand when the breach surfaced in March.

What happened

An IOL investigation published on 12 November found South African identity documents, bank statements, payroll files and school records offered on leak sites run by several ransomware groups. The 453,362 job-seeker records come from the Statistics SA breach, which the agency confirmed in March and reported to the Information Regulator; the attackers had asked for $100,000, about R1.7m, and a same-sized archive now sits on a dark web marketplace at $2,000.

Named victims include Grey High School in Gqeberha, listed by LockBit on 17 June with pupils' birth certificates, parents' identity documents and class lists; Elundini Local Municipality, listed in December 2025 with payroll, database and residents' documents; VSB Attorneys, listed on 7 September with bank statements, deeds and home loan agreements; and Lydenburg Toyota in Mpumalanga, listed by The Gentlemen on 31 October. The Information Regulator has received more than 8,000 breach notifications to date, 1,220 of them between 1 April and 31 August 2026, and expects more than 3,000 for the financial year.

Who is affected

  • Job applicants who submitted CVs, certified identity copies and qualifications to a breached system.
  • Pupils and parents whose birth certificates and identity documents were copied from a school's servers.
  • Law firm and dealership clients whose bank statements and property documents were published.
  • Any South African organisation that still keeps identity document copies, payslips or proof of address it no longer needs.

What to do now

Treat every retained copy of a client's identity document as a liability that has to justify itself, and assume some of your own documents are already circulating.

  • Purge identity copies, CVs and proof-of-address files that no law or contract requires you to keep, and record the retention rule you kept them under.
  • Re-check POPIA section 22 duties: notify the Information Regulator and affected data subjects as soon as you are reasonably sure a compromise occurred, not once it is confirmed.
  • Warn staff and clients about impersonation that quotes real reference numbers, and watch for SIM swaps and credit applications opened in their names.
  • Ask your software and service suppliers directly whether they hold your client data, and get the answer in writing before December.

What this means for South African businesses

The price is the real signal here, not the breach count: when a full archive of identity documents and CVs sells for the price of a used laptop, supply has outrun demand and the records of ordinary clients are the commodity. For an SME the practical consequence is that a future phishing or invoice-fraud attempt may be built from a breach you never suffered, which makes verifying payment changes on a phone call a control rather than good manners. For an MSP, this is the argument that data minimisation, segmentation and tested backups are POPIA evidence and not only resilience spend.

Source: IOL investigation into South African data on ransomware leak sites.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Node.js CVE-2026-123864: HTTPS flaw leaks TLS keys, patch to 22.23.5, 24.22.3 or 26.13.1
Cross-connection memory disclosure in the HTTPS parser, plus HTTP/2 teardown flaws in the same release