Capitec orders card replacements over the Pick n Pay legacy-app breach, mystery medical-aid breach identified as Profmed via PPSHA with five schemes exposed, Oracle EBS Payments CVSS 9.8 exploited before the KEV.
#OpSouthAfrica hacktivists breach Correctional Services (~11 GB) and Ephraim Mogale Municipality, IR serves 10-day notices on TransUnion and Experian, Standard Bank leak attributed to Prinz Eugen/ROOTBOY publishing 100,000 rows/day.
FortiBleed exposes ~74,000 FortiGate firewalls with plaintext credentials, Splunk Enterprise CVSS 9.8 pre-auth RCE actively exploited, 2026 npm/GitHub supply-chain campaign attributed to a South African operator.
AVBOB knocked offline (350+ branches), record 208-CVE Patch Tuesday led by a wormable kernel RCE, SAPS Western Cape breach exposes 2,978 officers’ medical records, Ivanti Sentry 10.0 weaponised in under 24 hours.
National supercomputer Lengau forced offline by credential breach, ROOTBOY publicly releases full 1.2 TB Standard Bank dataset, NETSCOUT ranks SA #1 globally for DDoS against banking, Cisco SD-WAN takes its 7th zero-day of 2026.
PAN-OS GlobalProtect CVSS 9.3 moves to mass exploitation, Pick n Pay/Bottles breach confirmed under POPIA s.22, first China-APT compromise of a SA university (Webworm), Exchange OWA deadline passes with no patch.
SA ISP ransom-DDoS wave peaks at 676 Gbit/s across 5 providers, Defender OOB patches after 7+ weeks, new CVSS 10.0 cPanel vuln, SA added to Lazarus APT target geography.
SANBS KillSec claim (unverified), Merensky Timber and Sew Treat hit by BlackSuit, SA tally reaches 111, Cisco SD-WAN CVSS 10.0 KEV deadline, Exchange OWA zero-day with no permanent patch.
Standard Bank formally indexed on ransomware.live (108th victim), Ekurhuleni R2 billion billing fraud, ShinyHunters Canvas 12 May deadline threatens 5 SA universities, APT28 SAMA expansion.
Stormous claims CGCSA (151K+ docs, Unilever/Nestlé partner data), SA victim count reaches 107, IR files first major court action against Blouberg Municipality for unpaid POPIA fine.
Standard Bank scope expands to credit cards and passports, XP95 deadlines lapse, Polmed SAPS data goes public, Defender zero-day trio — two still unpatched, Bitwarden CLI supply chain attack.
CRITICAL: Standard Bank 1.2 TB released by ROOTBOY, XP95 deadline arrives, Polmed exposes 100K+ SAPS officers, Adumo POS source code on dark web, Cisco IOS-XE CVSS 9.8 zero-day.
XP95 20 April deadline 7 days away, Salt Typhoon confirms first SA telecom nation-state breach, Krybit claims Megasurf ISP, IR compels dual-entity Liberty/Standard Bank disclosure.
DragonForce pivots to SA healthcare, Windows CLFS zero-day exploited in ransomware chains, and FSCA Joint Standard enforcement begins.
LockBit 5.0 resurfaces targeting SA financial institutions, Nightspire escalates infrastructure attacks, and SARB mandates 24-hour incident reporting.
Interlock exploits Cisco zero-day for 5 weeks undetected, DragonForce hits SA insurer, and POPIA issues real fines.
Threat level escalated to HIGH — SA businesses breached every 3 hours as ransomware and data theft surge.
Analysis of regional ransomware spikes and critical CVEs affecting South African infrastructure this week.