Stats SA Hit by Cyberattack: Hackers Demand R1.7 Million Ransom for 154GB of Stolen Data

South Africa’s statistics agency, Stats SA , has fallen victim to a data breach affecting one of its departments, the agency confirmed.

The Attack

The cyberattack was perpetrated by a cybercrime group known as XP95 , which breached the Gauteng Provincial Government earlier this month.

In the latest attack, the hackers claim to have stolen 453,362 files totalling 154 GB of data from an unspecified Stats SA server.

The cyber-extortionists have demanded a ransom payment of $100,000 (R1.7 million) to prevent the public release of the stolen data.

Stats SA’s Response

Stats SA said it was aware of the data breach affecting the human resources database.

“The system that was breached is exclusively the HR system available for job seekers to apply online,” said Semakaleng Thulare , the acting DDG of Statistical Support and Informatics at the agency.

“The national statistics office is part of a wider government response to matters dealing with cybersecurity breaches.”

Stats SA said it will notify the information regulator and will be “guided by their processes.”

The Deadline

XP95 has set a 20 April 2026 deadline for the payment, after which the group threatens to leak the full Stats SA archive online, according to MyBroadband.

Who Is XP95?

The XP95 group is a relatively new actor in the cyber-extortion space, having first emerged in March 2026 with a unique interface that mimics legacy Microsoft Windows operating systems.

From the site design, it appears that the group’s name is an amalgamation of two old versions of Microsoft’s operating system: Windows XP and Windows 95 .

South Africa’s Cybersecurity Gap

In 2025, The Citizen reported that South Africa remained a target of cybercriminals, ranking 27th globally among the most breached countries.

A report by Surfshark revealed that in 2025, a total of 369,600 accounts were leaked in the country.

Between April and June, more than 21,000 South African accounts were breachedapproximately three per 100,000 people.

In total, South Africa has had 124.2 million personal records exposed since 2004.

The Bottom Line

Stats SA is the latest government agency to be hit. XP95 is the latest threat actor. The ransom demand is R1.7 million.

The data is stolen. The deadline is 20 April. And South Africa’s cybersecurity gap remains wide open.

{Source: Citizen}

Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram

For more News in Johannesburg, visit joburgetc.com