SA data leaks: What to do if your ID, bank details or CV have been stolen

A growing South African data leak problem means your personal information could already be in criminals’ hands, and you may not know it.

Identity documents, bank statements, CVs and even school records belonging to ordinary South Africans have turned up on websites run by ransomware gangs.

The good news is that there are simple steps you can take right now to protect yourself.

The latest South African victim is Lydenburg Toyota, a car dealership in Mashishing, Mpumalanga.

Hacking group The Gentlemen listed it on its leak site on 31 October, inviting buyers to contact them for the dealership’s data.

Toyota SA Motors has confirmed a ransomware-related incident at the dealership and says an investigation is under way.

How big is the South African data leak problem?

Over the past year, stolen records from several South African organisations have appeared on ransomware leak sites.

They include Grey High School in Gqeberha, Elundini Local Municipality in the Eastern Cape, law firm VSB Attorneys and Statistics South Africa.

In one case, hackers stole 453 362 job seekers’ records from Stats SA’s online job application system.

They first demanded $100 000 (about R1.65 million) to keep the data offline. The same archive is now advertised for about $2 000 (about R33 000).

The number of reported breaches is rising fast.

The Information Regulator has received more than 8 000 breach notifications to date, including 1 220 between 1 April and 31 August 2026 alone.

It expects more than 3 000 by the end of the financial year.

At a media briefing on 31 August, regulator chairperson Pansy Tlakula described the rate as “very alarming”.

The regulator says the real figure is likely higher, because some organisations don’t report breaches.

It also says human error causes most reported breaches, rather than deliberate cyberattacks.

A listing on a leak site doesn’t always mean anyone has confirmed a breach.

Cybersecurity company Orange Cyberdefense warns that people should treat a listing as an unverified allegation until someone independently corroborates it.

What to do right now about the South African data leak

The leaked files reportedly include:

• copies of identity documents
• bank statements and home loan agreements
• payroll records
• CVs and qualifications
• pupils’ birth certificates and school records.

According to Andrew Henwood, founder of digital forensics firm BlckRhino, an ID copy, a payslip and a bank statement together give a fraudster everything needed to open accounts, apply for credit, swap a victim’s SIM card or pose as a parent.

“That combination is effectively a complete identity kit,” he said.

Henwood warned that criminals often use stolen data years later, when victims are no longer on guard.

Children’s identities are especially attractive, he said, because misuse can go unnoticed for years.

How to check if your personal information is exposed

You can’t check every leak, but you can look for warning signs:

• Check your email address on Have I Been Pwned, a free tool that shows whether it has appeared in known data breaches.
• Check your credit report. Under the National Credit Act, you are entitled to one free credit report a year from each credit bureau. Look for accounts or credit applications you don’t recognise.
• Watch your bank statements for small or unusual transactions.
• Look out for unexpected messages, such as OTPs you didn’t request, or requests to pay into new bank details.

What to do right now

If you think your personal information has been exposed:

1. Change your passwords, starting with your email and banking apps. Use a different password for each account.
2. Switch on two-step verification (multi-factor authentication) wherever you can.
3. Never share an OTP or PIN with anyone, even someone claiming to be from your bank.
4. Check any unexpected payment request by phoning the company on a number you already have, not one in the message.
5. Apply for free Protective Registration with the Southern African Fraud Prevention Service (SAFPS). This alerts its member organisations, such as banks and retailers, to take extra care before opening accounts in your name. You will need a smartphone to apply online.
6. If your ID is used fraudulently, report it to your bank, open a case at your nearest police station and inform SAFPS.

What companies are supposed to do

Under the Protection of Personal Information Act (POPIA), companies must take reasonable steps to protect your data.

They must also notify the Information Regulator and affected people when there are reasonable grounds to believe someone has accessed personal information without permission.

Paying a ransom does not protect the people whose data was stolen.

“You are buying an unverifiable promise from a criminal,” Henwood said.

If you believe a company has mishandled your data, you can lay a complaint with the Information Regulator.