SA Threat Brief: Week 43

What Business Owners Need to Know This Week

Week 43 (11–17 October 2026): two South African organisations answered a disclosure question this week and gave opposite answers. Ampath, one of the country’s largest pathology groups, detected an intrusion on 2 October, notified the Information Regulator, published a POPIA section 22 notice on the eleventh day naming the attacker and the data categories, and when the attacker claimed 80 million patient records it explained within a day why a row count is not a patient count. The Gauteng Department of e-Government, three weeks after a student showed GroundUp that its R269 million panic-button app served its database to anyone, says it has approached the police about a criminal case. Elsewhere, The Gentlemen listed Europ Assistance South Africa in a 33-name batch on a Friday morning, in the week Microsoft placed the group fourth in the world by leak-site postings; Deadlock took its second South African name; and CISA added nine exploited vulnerabilities to its catalogue, four of them on the network edge and two of those used before a patch existed.

The Bottom Line: If your organisation holds patient, member or policyholder records, write down now how you would answer a claimed record count within 24 hours: which systems hold one row per person and which hold one per event, who signs the section 22 notice, and what you say about the sensitive fields before you know. On the technical side, three edge appliances need a compromise check before a patch this week, and for Ivanti Connect Secure CISA says the vendor’s own integrity checker may not detect the intrusion, so a clean result should not be read as a clean appliance.

The Week in Numbers

• 138 cumulative SA ransomware victims — up 2 from 136; HIGH threat level for the 26th consecutive week.
• 80 million — the number of records the actor ByteToBreach claims from Ampath’s admissions table. Ampath says the figure counts database rows, not people, and has given no count of individuals. The claim is unverified.
• 11 days — from Ampath’s detection of the intrusion (2 October) to its public section 22 notice (13 October).
• 33 names in one morning — what The Gentlemen posted on 16 October, including MoneyGram, KFC, Confluent and Europ Assistance South Africa; the group’s index rose by 42 in the week to 1,002.
• 17 South African ransomware cases — Microsoft’s count for the year to June 2026, up from seven, the third-steepest rise of the twelve countries its Digital Defense Report singles out and the only African entry; Microsoft names no organisations.
• 9 new CISA KEV additions — Ivanti Connect Secure, Windows Shell, Cisco Secure Email Gateway, PAN-OS, two AhsayCBS flaws, Atlassian, BeyondTrust Remote Support and Fortinet; seven were past their deadline on Monday 19 October.
• 105 exploitation attempts from 50 addresses — logged against Ivanti Connect Secure honeypots by 14 October, the day after the fix.
• 2,801 FortiGates — exposed to the internet in South Africa, 1,524 of them on the SSL VPN port; no South African population can be counted for the Ivanti, Cisco or Palo Alto appliances.
• 7 addresses — on The Gentlemen’s indicator feed since 11 October that earlier editions did not export; they are in this week’s IOC file.
• 4 November — local government elections, two and a half weeks away; the IEC’s disinformation code has been in force since 4 September.

Major Incidents: Who Was Hit and How

Ampath — A Confirmed Intrusion and a Disputed Number

Ampath detected a cyber incident on Friday 2 October and issued a notice under section 22 of POPIA on Tuesday 13 October, the day the actor ByteToBreach posted on a criminal forum. The notice lists names, identity numbers, dates of birth, contact details, medical scheme names and membership numbers, and payment records as the data that may have been taken, and says there is no indication that health, diagnostic or clinical information was in the affected data. The actor claims ten of about 375 databases copied in full and an admissions table of more than 80 million rows. Ampath’s answer the next day: the figure refers to database records rather than unique individuals, one patient generates many records over years, and there is no evidence that test results, diagnoses or banking details were compromised. Containment, by the company’s account, included blocking malicious addresses, removing unauthorised files, disabling compromised accounts, fixing a vulnerability in application functionality and restoring the affected web server from a clean backup, which describes an internet-facing application compromise. The incident is rated CONFIRMED on the company’s own notice; the database count, the record count and the data span are the actor’s claims and are not adopted. ByteToBreach, as KELA profiles it, is a single data-leak operator assessed to be in Algeria, who sells and leaks databases rather than encrypting networks, with a track record against banks in Seychelles and Nigeria.

Europ Assistance South Africa — Listed by The Gentlemen in a 33-Name Batch

The Gentlemen listed Europ Assistance South Africa, which the aggregator describes as a Roodepoort emergency-assistance and insurance-administration company, at 09:31 UTC on Friday 16 October, one of 33 organisations the group indexed that day. No data size, sample, deadline or published-data marker was on the record on 18 October, and no South African publication had carried it by the close of the window. It is the group’s thirteenth South African name since January and its fifth in the insurance and administration cluster after Hollard, Guardrisk, LegalWise and Samwumed; whether Europ Assistance has any connection to the June MIP Holdings breach is unknown and is not inferred. What distinguishes it from the September listings is the batch: the three 30 September names went up in one minute with timers, while Europ Assistance went up in a global dump that moved the index by more in a day than the group managed in the whole of the W40 week. That is the pattern Microsoft’s Digital Defense Report describes when it cautions that the group’s leak-site activity may be pushed to attract attention, because newer families are a far smaller share of Microsoft’s own telemetry. The listing is CLAIMED.

Gauteng e-Panic Button — The Department Approaches the Police

Three weeks after GroundUp’s Joel Cedras showed that the e-Panic Button app’s database could be read without authentication (the developer, Evolve, fixed it the next day), the Gauteng Department of e-Government has described the disclosure as a security compromise, says it has contacted SAPS about a criminal case, and has sent residents an SMS stating that it is investigating a cybersecurity incident affecting the app. MEC Bonginkosi Dhlamini told MyBroadband that opening police cases when security breaches are recorded is standard practice and that a report will be made public at the right time. Cedras told EWN his method was static analysis, that no law was broken, and that the department never answered his emails; the DA’s Michael Waters called the plan absurd. Whether a case has in fact been registered, and against whom, is unconfirmed. South Africa has no safe-harbour provision for security research: the Cybercrimes Act’s unlawful-access offence carries no research exception, so the only protection a researcher has is prosecutorial discretion. The SMS is the only notice residents have received from the department; it came after the fix, names no data category and no date, and is not a section 22 notice in the form the regulator’s guidance describes.

Bootlegger — A Legacy Dashboard Served Franchise Data to Anyone With the Link

An internal operations dashboard belonging to the Bootlegger coffee franchise sat behind a login screen but sent its data with the login page, readable in the page source by anyone with the URL: names and contact details for 132 locations, franchisee and operator names and email addresses, general managers’ mobile numbers, and performance and pipeline data. Bootlegger says it became aware on the afternoon of Thursday 15 October, that the platform was a legacy application already migrated and not fully decommissioned, that it was taken offline the same day, that no customer data was collected on it, and that it will notify the Information Regulator. CONFIRMED on the company’s statement and MyBroadband’s verification of the exposed data. The failure was a decommissioning failure, and the detail that travels to other estates is that an application showing a login page is unprotected if the data arrives before the login.

Aeroklas Duys — Deadlock’s Second South African Listing

Deadlock, an encrypting ransomware operation with 107 listings in 42 countries since June, listed Aeroklas Duys, the automotive accessories manufacturer in the Duys Engineering Group, on Monday 12 October; its first South African listing was the Furniture Bargaining Council in August. No data size, sample or deadline was on the record, and the company has published nothing. The group matters more than the victim: it uses a Session identifier in its ransom note, AnyDesk for persistence, proxy addresses held in Polygon smart contracts and vulnerable-driver abuse to disable defences, and the aggregator’s indicator feeds carry nothing for it, so the hunt rests on one vendor sample hash from June and those behaviours. CLAIMED.

Four Edge-Appliance Flaws in One Week

Ivanti Connect Secure CVE-2026-104935 is an authentication bypass triggered by a single request with a crafted X-DSCGI-PATH header. Volexity saw a criminal actor chain it with an unpatched privilege-escalation flaw to root from 3 October, pulling appliance credentials, Active Directory metadata and BitLocker recovery keys, and re-exploiting the device for each command so that the Integrity Checker Tool found nothing; CISA says the tool may not detect this intrusion and prescribes network and memory forensics, then a factory reset, rebuild and rotation of every credential and certificate on a hit. Cisco Secure Email Gateway CVE-2026-76519 is a root file write triggered by a crafted email attachment where File Reputation is enabled; Cisco reports active exploitation in October, and the compromise check is grep "System Security" system_logs on every appliance. It is the second Secure Email Gateway catalogue entry in five weeks. PAN-OS CVE-2026-0322 gives root to an authenticated user of the management interface; Palo Alto Networks reports very limited exploitation and publishes three attacker addresses, and the precondition is a credential, which the stealer-log figures on this week’s victim pages show is not a hypothetical problem. The fourth entry, a Fortinet CLI path traversal, needs an administrator session. Also catalogued: a Windows Mark of the Web bypass exploited as a zero-day in Microsoft’s record 1,411-fix October release, an AhsayCBS backup-console chain being used against managed service providers’ customers to run cryptocurrency miners, where the version the vendor called fixed is also affected, an Atlassian file-read flaw across eight Data Center products, and a BeyondTrust Remote Support bypass. The SonicWall SMA 1000 flaw flagged last week is still outside the catalogue after 135 recorded exploitation attempts.

POPIA and Regulatory

Ampath’s notice as a template. Section 22 requires notification of the Regulator and the data subjects as soon as reasonably possible, in enough detail for people to protect themselves. The notice, as the press carried it, does that: data categories, consequences, measures taken, advice (do not engage with anyone claiming to hold the data, watch accounts and credit records, consider protective registration with the Southern African Fraud Prevention Service) and the identity of the actor. What it could not do on 13 October was state a number of individuals, and the actor supplied one; the company’s one-paragraph explanation of rows versus people the next day is the part other organisations should study. The Regulator’s pages carried nothing on Ampath, Bootlegger or e-Panic by 18 October, and its enforcement register still ends at 10 June. Parliament: the Defence Minister’s written reply, reported by MyBroadband, describes the SANDF’s posture against Interpol’s assessment: monthly vulnerability assessments, two penetration tests a year, a Cyber Defence Strategy for 2025 to 2030, and partnerships with SITA and the State Security Agency; the same article carries the Weather Service’s account of the January 2025 RansomHub attack cutting its fourth-quarter performance to 36% of targets from 91%. Elections: local government elections are on Wednesday 4 November. The IEC’s disinformation code has bound parties and candidates since 4 September, with a 36-hour retraction duty and Real411 as the reporting channel; Telkom announced a R20 million connectivity partnership with the IEC on 16 October; and the Regulator’s 2024 statement on an IEC security compromise is the precedent for the coming fortnight. Fraud advisories: BusinessTech’s WhatsApp warning covers SIM swap and link-based account takeover, with Discovery Bank’s line that a bank never asks a customer to approve a reversal; Kaspersky prices DDoS kits from one dollar while Seacom estimates up to R2.5 million per attack for a South African company; and SARS has issued no scam alert since SARS-SCAM-400 on 2 September.

Corrections to Earlier Editions

Two items. First, Weeks 40, 41 and 42 printed a SonicWall family exposure figure for South Africa of 2,912, 2,960 and 2,965, described as the sum of five Shodan product strings. The sum was wrong in two ways: the generic string already contained three of the others in its own facet, so those appliances were counted twice, and the string “SonicWALL, Inc.” resolves to Juniper, Fortinet, Alcatel-Lucent and Aruba devices alongside SonicWall ones, mostly on the SNMP port. It is a vendor banner, not a product fingerprint. The family figure is withdrawn and replaced by the single product count, 1,206 instances on 18 October; the prior figures should be read as overstated by roughly two and a half times. No conclusion in those editions rested on the family total. Second, Week 42 stated that The Gentlemen’s indicator feed was unchanged since 27 September. It was not: the 11 October retrieval carried seven addresses and a second Session identifier that appear in no earlier retrieval, so the statement was wrong at publication and the Week 40 hunt mission lacked those rows. They are exported this week. Both corrections are recorded in the report’s Section 1 and Section 12.

Full Intelligence Report

The complete Week 43 technical report covers the Ampath record and the ByteToBreach profile, the Europ Assistance and Aeroklas Duys listings with the Deadlock behaviours, the e-Panic development and the research safe-harbour question, Bootlegger’s exposure, all nine KEV additions with the Ivanti header and addresses, the Cisco log check and the PAN-OS addresses, the AhsayCBS file and service names, VERIFIED South African exposure counts, the election fortnight tests, eight structured hunt missions with a 79-row IOC table, the two corrections, and the full source list of 54 entries.

What Your Business Should Do Right Now

• Treat the three exploited edge flaws as one incident-response task, closed by Wednesday 21 October: Ivanti Connect Secure: upgrade to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1, then search gateway logs since 1 October for requests carrying the X-DSCGI-PATH header and for the four Previdian addresses; treat a clean Integrity Checker result as no information, and on any hit factory reset, rebuild and rotate every credential, certificate and API key. Cisco Secure Email Gateway: run grep "System Security" system_logs on every appliance and cluster member and update Content Scanner Tools to 25.3.0.5525 or later. PAN-OS: take the management interface off the internet, patch to the fixed release for your line, and search for the three advisory addresses.
• If you hold patient, member or policyholder records, prepare the Ampath answer by Friday 23 October: Which tables hold one row per person and which hold one per event, so that records and people can be separated in a statement within 24 hours; the section 22 notice template with the data categories pre-mapped; and a call-centre briefing that a caller quoting a correct medical-scheme or policy number is not thereby verified.
• Run a decommissioning and management-plane inventory by Friday 23 October: List every application migrated away from this year and confirm the old one is down; test every internally built dashboard for data delivered with the login page; and restrict every backup, remote-support and firewall management console to trusted addresses. AhsayCBS has no working patch, so the console must stop answering the internet; managed service providers do this per client tenant.
• Add the seven addresses, the Session identifier and the new hash on The Gentlemen’s feed, and the Deadlock sample hash, to blocklists on Monday 19 October and retro-hunt 30 days: All are in this week’s IOC file with their sources. For an insurer, administrator or scheme, keep the watch on your own name across leak sites with the country tag ignored; this group listed 33 names in one morning.
• Decide, as policy, what the organisation does when an outsider reports a flaw: The alternative to a police case is a published disclosure channel, a commitment not to pursue a good-faith reporter who stays within the data needed to demonstrate the flaw, and a fix-first sequence. The law gives no safe harbour, so the policy is the only one a researcher can rely on, and it is the board’s to set.
• Build a database-export baseline by Friday 30 October: A data-leak operator’s intrusion produces no encryption event to alert on; it produces a read volume. Establish the normal daily read volume of every database holding personal information, by account, and alert on an order-of-magnitude departure.
• Put the election fortnight on the agenda for Monday 26 October: For a municipality, a utility or a media organisation the questions are DDoS capacity, the integrity of public-facing results and notice pages, and who speaks if a hacktivist channel claims an outage that did not happen. A claim without an operator’s confirmation stays a claim.