2026 African National Congress — Black X publishes alleged 2.3M member records (unverified)
Data compromised
Actor-published alleged records: full names, South African ID numbers, phone numbers, physical and email addresses for ~2.3M rows; samples cited top officials including Cyril Ramaphosa, Paul Mashatile, Panyaza Lesufi, Gwede Mantashe, Nomvula Mokonyane—ANC had not confirmed by June 22 reporting and previously disputed breach claims via ICT provider Emperio
Technical writeup
Unverified deep-web publication — June 22, 2026. MyBroadband reported that hacker group Black X published nearly 2GB of alleged ANC member personal information, roughly 2.3 million records with names, ID numbers, phones, physical and email addresses. MyBroadband reviewed samples listing senior officials including President Cyril Ramaphosa, Deputy President Paul Mashatile, Gauteng Premier Panyaza Lesufi, Mineral Resources Minister Gwede Mantashe, and deputy secretary general Nomvula Mokonyane. The publication followed Black X’s claimed August 2025 breach of the ANC membership platform; in June 2026 the actor added a password unlocking the files after earlier selling database access alongside four other claimed victim datasets. The ANC did not respond by publication; it previously told MyBroadband that Emperio’s preliminary investigation found no conclusive evidence of unauthorized access to the current production database and characterized the threat as opportunistic extortion or possible historical exposure. South Africa’s Information Regulator said the ANC had not formally reported a POPIA section 22 compromise as of June reporting. Distinct from the May 2026 forum marketing entry (african-national-congress-member-data-claim-may2026). BreachHistory indexes the actor-cited 2.3M figure as unverified.
Root cause
Black X threat actor published ~2GB alleged ANC membership dump on deep web; follows August 2025 claimed breach of ANC membership platform