Late March 2026, Statistics South Africa (Stats SA) confirmed a cyber incident affecting an internal human-resources platform used by job seekers—not the agency’s core statistical databases. News outlets described roughly 154 GB of data across a large number of files and attributed activity to the XP95 extortion group, including a ransom demand and publication deadline.
Agency response
Stats SA indicated it would notify South Africa’s Information Regulator and follow POPIA processes. Officials emphasized the compromised system was limited to HR applications.
Takeaways
Even non-statistical systems at national agencies hold sensitive applicant PII. Extortion groups increasingly pressure public-sector targets with leak threats.
Details and citations: Stats SA 2026 breach on BreachHistory.
Source: The Witness