A Courier Guy data leak on the dark web is raising fresh questions for South African customers, and not only because of what was taken. According to reporting from MyBroadband, the ransomware group MedusaLocker may have breached the company and copied its data purely to sell it on to other online threat actors, without ever contacting The Courier Guy to demand a ransom.
That possibility matters because it may explain why The Courier Guy reportedly could not find evidence of an intrusion into its systems. For customers, the practical lesson is simple: a company saying it found no breach is not the same as your data being safe.
What MedusaLocker leaked from The Courier Guy
The source report describes private files belonging to South Africa's top courier company appearing on the dark web, with MedusaLocker linked to the leak. The article text available to us does not spell out every category of file or the exact volume of data involved, so we will not guess at those details here.
What the report does establish is the working theory: MedusaLocker may have breached the company and exfiltrated data with the aim of selling it to other threat actors. In that scenario, the leak is not a pressure tactic aimed at the victim. It is a product being offered to buyers.
MedusaLocker is a ransomware group, and this group has been tied to other high-profile incidents in the country. Our earlier coverage of the ransomware group behind the ANC, SAA and Pick n Pay breaches looks at how a single operation has hit several recognizable South African institutions, which helps place this incident in context.
Why a breach with no ransom demand is harder to detect
Most people picture a ransomware attack as a loud event: systems locked, a ransom note on screen, a deadline. That visible disruption is often how companies discover they have been breached.
A data-theft-only intrusion can be much quieter. If attackers copy files and leave without encrypting anything or sending a demand, there may be no obvious trigger for an investigation. The report suggests this could be why The Courier Guy found no evidence of an intrusion.
This is worth understanding because it changes how you should read company statements. "We found no sign of a breach" can mean the logs show nothing, not that nothing happened. Without a ransom demand, the first public signal may be a listing or leak on the dark web, which is exactly the situation described here.
What exposed names, addresses and ID details mean for customers
Courier companies hold the kind of information that is useful to criminals: names, phone numbers, email addresses and physical addresses for both senders and recipients. The report's framing points to private files, and customers should assume that routine delivery details could be among what is circulating, until the company confirms otherwise.
The real danger is usually not the leak itself but what follows:
- Delivery-themed phishing. Scammers who know you use a courier can send convincing messages about missed deliveries, customs fees or redelivery payments.
- Identity fraud. If identity details are included, they can be combined with other leaked data to open accounts or impersonate you.
- Targeted social engineering. Knowing your address and recent parcel activity makes a fraudulent call or SMS far more believable.
Because stolen data may be resold to multiple buyers, the risk can spread beyond the original attacker and last well after the initial headlines fade.
How to reduce your risk after a courier data leak
You cannot pull your data back off the dark web, but you can make it far less useful to anyone holding it.
- Treat unexpected delivery messages with suspicion. Do not tap links in SMS or email about a parcel. Go to the courier's official app or website directly, or check the tracking number yourself.
- Never pay a small "redelivery" or "customs" fee requested through a message you did not expect.
- Use unique passwords for every account and turn on two-factor authentication, especially for email and banking.
- Monitor your accounts and credit profile for activity you do not recognize, particularly if you have shared ID details with a courier.
- Check breach-notification tools to see whether your email address has appeared in known leaks.
- Be cautious with callers. If someone phones claiming to be from a courier or your bank and cites your address or parcel, hang up and call back on an official number.
What This Means For You
If you have sent or received parcels through The Courier Guy, assume your contact and delivery details may be exposed and act accordingly. You do not need to panic, but you should raise your guard against phishing, since that is the most likely way this data gets used against you.
The broader point is that you cannot rely on a company's detection alone. When attackers skip the ransom and go straight to selling data, customers may learn about a breach only after the files are already circulating.
Key takeaways
The Courier Guy data leak on the dark web is a reminder that exposure can happen even when a company finds no trace of an intrusion. Check whether your details appear in known leaks, treat every unexpected delivery message as suspect, and strengthen your passwords and two-factor settings today. To understand the wider pattern, read our coverage of the ransomware group linked to other major South African breaches and see how these attacks keep reaching the services people use every day.
