Ransomware Group Behind ANC, SAA, Pick n Pay Breaches

A single ransomware group has managed to breach some of South Africa's most recognizable institutions, including the African National Congress (ANC), Anglo American, Mediclinic, South African Airways (SAA), and Pick n Pay. The common thread across these incidents is double extortion ransomware, a tactic that has become the default playbook for cybercriminals targeting large organizations across South Africa and beyond.

What makes this string of breaches notable isn't just the size or prominence of the victims. It's that a single threat actor was able to repeatedly find its way into vastly different sectors: a political party, a mining giant, a private healthcare provider, a national airline, and a major retailer. That range says a lot about how ransomware groups operate today, and why double extortion ransomware in South Africa has become such a persistent problem for organizations that hold customer, patient, or citizen data.

What Happened: The Ransomware Group Behind the ANC, SAA, and Pick n Pay Breaches

According to reporting, the same ransomware threat has been linked to intrusions at the ANC, Anglo American, Mediclinic, SAA, and Pick n Pay. Rather than targeting a single industry or type of organization, this group has cast a wide net across government-adjacent bodies, corporate giants, healthcare providers, and consumer-facing retailers. That breadth suggests the group is opportunistic, going after whichever networks it can compromise rather than sticking to a specific sector or motive.

Each of these organizations holds different but equally sensitive categories of data. The ANC holds political and membership information. Anglo American, as a global mining company, holds corporate and operational data. Mediclinic holds patient health records. SAA holds passenger and travel data. Pick n Pay holds customer loyalty and transaction data. A single group being able to reach across all of these different environments underscores how ransomware operators today aren't just after one type of prize; they're after leverage, wherever they can find it.

How Double Extortion Ransomware Differs From Traditional Attacks

Traditional ransomware was relatively simple: attackers would encrypt a victim's files and demand payment in exchange for a decryption key. Over time, organizations got better at defending against this model by maintaining offline backups, which meant they could restore their systems without ever paying the ransom.

Ransomware groups adapted. Double extortion ransomware adds a second layer of pressure. Before encrypting a victim's systems, attackers first quietly copy, or exfiltrate, sensitive data from the network. Once the encryption is triggered and the ransom demand is delivered, the victim faces two separate threats: pay to get systems back online, and pay again (or in addition) to stop the stolen data from being published or sold online.

This approach neutralizes the backup defense that many organizations rely on. Even if a company can restore its systems from backups without paying a ransom, it still has to contend with the fact that its data, whether that's financial records, health information, or customer databases, is sitting in the hands of criminals who are threatening to leak it. That's precisely why double extortion has become the dominant ransomware strategy: it gives attackers a second point of leverage even when their first one fails.

Why This Matters If You're a Customer of These Organizations

If you're a member of the ANC, a patient at Mediclinic, a frequent flyer with SAA, a Pick n Pay Smart Shopper, or connected to Anglo American in any capacity, this kind of breach isn't just an abstract corporate problem. It's a direct risk to your personal information. Double extortion attacks specifically target the kind of data that has value beyond the organization itself: names, contact details, ID numbers, financial information, health records, and loyalty program data.

When that data ends up in the hands of a ransomware group, it doesn't necessarily stay contained. Stolen records from breaches like these often get published, sold, or circulated on criminal forums, sometimes long after the initial incident fades from headlines. The scale of exposure can be enormous. For a sense of how large these downstream effects can get, the Mexico data breach that exposed 195 million identities shows just how far-reaching a single large-scale intrusion can become once stolen identity data starts circulating.

Unlike state-linked cyber campaigns, which often focus on espionage or infrastructure disruption as seen in the state-sponsored attacks reported in Singapore, double extortion ransomware groups are financially motivated. That means the data they steal from you is treated as a commodity, something to be monetized through ransom payments, resale, or public leaks designed to pressure the victim organization.

Practical Steps to Protect Your Data After a Third-Party Breach

You can't control whether an organization you do business with gets breached, but you can control how you respond and how exposed you remain afterward.

• Check whether your information was part of any breach notifications from the ANC, Anglo American, Mediclinic, SAA, or Pick n Pay, and follow any specific guidance they provide.
• Change passwords for any accounts tied to these organizations, especially if you reused that password elsewhere.
• Enable two-factor authentication wherever it's offered, particularly for financial, healthcare, and loyalty accounts.
• Monitor bank and credit statements for unfamiliar transactions, since financial and identity data is often the most valuable asset stolen in these breaches.
• Be cautious of follow-up phishing attempts, since stolen personal details are frequently used to craft convincing scam emails or messages that reference real account information.

The Bigger Picture on Double Extortion Ransomware in South Africa

The fact that one ransomware group could reach into a political party, a mining conglomerate, a healthcare network, an airline, and a retailer illustrates how double extortion ransomware in South Africa has become a shared risk across sectors, not a niche problem for any single industry. Organizations are responsible for securing their networks, but individuals also play a role in limiting the damage once a breach occurs.

Staying informed about which organizations you interact with have been affected, updating your credentials promptly, and watching for signs of misuse are practical, achievable steps. Data breaches involving major institutions will keep happening, but how quickly you respond to them can make the difference between a minor inconvenience and a serious identity theft problem.