South Africa’s Private Healthcare Hit by Cyber Extortion: What We Know About the Mediclinic Hack

It’s becoming harder to ignore the rising tide of cybercrime sweeping through South Africa — and this time, it’s hit a major player in private healthcare. Mediclinic Southern Africa, a household name operating acute care hospitals in South Africa and Namibia, has been targeted by a notorious cyber extortion group called Everest Group.

The Attack Unfolds: What Happened to Mediclinic

Everest Group, a criminal gang operating in the shadows of the dark web, has claimed responsibility for breaching Mediclinic’s systems. They say they managed to extract around 4 gigabytes of data, including sensitive personal information belonging to roughly 1,000 Mediclinic employees. This is no small leak.

From screenshots posted on Everest’s leak site, it looks like the hackers accessed privileged parts of Mediclinic’s human resources systems. That means everything from salary details to disciplinary records — private stuff no one wants exposed. One image even showed a user’s home directory, indicating deep access.

Everest Group has given Mediclinic a tight deadline, demanding negotiations before 2 AM on Sunday, 1 June, to avoid releasing more stolen data.

So far, Mediclinic hasn’t publicly commented on the breach.

Who’s Behind the Everest Group?

The Everest Group isn’t new to the cybercrime scene. Security researchers say the gang was first spotted in late 2020 but flew under the radar because their attacks were slow and methodical.

Recently, however, they’ve stepped up their game — targeting large companies’ HR systems, including Coca-Cola and others.

Experts from Venarix and reports from Dark Reading suggest Everest’s entry points often come through a third-party SAP service provider called INK IT Solutions, based in Australia. That means these hackers exploit weak links in the supply chain to gain access.

Everest Group isn’t just about holding companies hostage themselves — sometimes they sell their initial access to others. This opportunistic strategy makes them unpredictable and dangerous.

South Africa Under Cyber Siege

Mediclinic isn’t the only South African company feeling the heat. Just this week, Adidas South Africa disclosed a breach that exposed customers’ personal details like names, emails, and birth dates. Meanwhile, telecom giants MTN and Cell C have also reported security incidents, with Cell C openly discussing a ransomware attack, and MTN remaining tight-lipped.

Cybersecurity experts warn that attacks like these are expected to rise as criminals worldwide become more aggressive. Charl van der Walt, head of security research at Orange Cyberdefense, recently told MyBroadband that South Africa could see a sharper increase in cybercrime than other countries.

Why Is South Africa More Vulnerable?

Van der Walt points out several factors that put local businesses and institutions at higher risk:

• Lower digital literacy means phishing and email scams can catch more victims.

• Weaker finance governance in companies leaves gaps for fraud and business email compromise scams.

• SIM swap fraud and alternative payment system thefts are becoming more common here.

He also highlights a growing threat from state-aligned hackers and hacktivists, who use cyberattacks as tools for espionage, political influence, or destabilizing critical infrastructure.

South Africa’s geopolitical position makes it a prime target for these complex campaigns, which can have long-term impacts on the country’s stability and economy.

What Should We Take Away?

The Mediclinic hack is a clear reminder that no sector is immune. Healthcare, with its wealth of personal and financial data, is a high-value target for cybercriminals.

Organizations need to tighten their digital defenses and prepare for increasingly sophisticated threats. For individuals, this is a wake-up call to be cautious with personal data and vigilant about cybersecurity in everyday life.

Stay Alert, Stay Safe

Cyberattacks like the Mediclinic breach show how deeply our lives are intertwined with technology — and how vulnerable that connection can be. South Africa’s businesses and citizens must stay informed, demand stronger protections, and adopt safer digital habits.

Keep following updates closely, and if you work in sectors handling sensitive data, now is the time to review your cybersecurity measures. The next attack could be just around the corner.