Pretoria – Statistics South Africa (Stats SA) has confirmed that its systems were breached by a cybercrime group known as XP95, which is demanding $100,000 (about R1.7 million) in ransom. The attack targeted a human resources (HR) database used by job seekers to apply for positions online.
XP95, a new and relatively unknown hacker group, claims to have stolen 154GB of data, comprising 453,362 files. The group, which emerged in March 2026, also claims responsibility for a recent breach at the Gauteng Provincial Government, where 3.8TB of data was reportedly stolen.
“Stats SA is aware of a cybersecurity breach affecting one Human Resources database. The system that was breached is exclusively the HR system available for job seekers to apply online,” the agency said in a statement. It added that it would not pay the ransom and would follow the guidance of the Information Regulator. 
Stats SA plays a central role in producing official data for government, business, and society, including population statistics, economic performance, employment, and living conditions. The agency confirmed that its response aligns with the Public Finance Management Act, ensuring state resources are deployed appropriately.
Cybersecurity experts note that repeated breaches in government systems often reveal weaknesses in legacy infrastructure. Doreen Mokoena, CEO of Cybersec Clinique, said attackers frequently return to systems if initial responses focus only on restoring services rather than removing intruders.
The XP95 group uses ransomware to encrypt and exfiltrate data, threatening to release it publicly if the ransom is not paid by 20 April 2026. Analysts warn that individuals who submitted applications via Stats SA’s portal may face identity theft, financial fraud, and targeted phishing attempts.
