INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Ransomware Group Threatens to Leak Customer Data from South African Insurers

| 2026-10-05 12:29 HIGH HIGH RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
A ransomware group, identified as The Gentlemen, has threatened to leak customer data from top insurance companies in South Africa. The entity is one of the most active cybercriminal organisations globally and accounted for 17% of all ransomware attacks worldwide in July. The operation involves breaching software used by local companies, including Hollard Insurance and MIP Holdings, a South African insurtech company that provides software to some of the country's largest insurers. The group is now seeking to extort third-party firms after stealing data from numerous other local companies when they breached MIP Holdings in June. Check Point Software attributes this activity to The Gentlemen.
Technical Mitigations AI-generated
• Patch MIP Holdings software to prevent data breaches. • Block or hunt for indicators of The Gentlemen's ransomware attacks, such as stolen customer data from insurance companies. • Detect and remove malware that uses the same tactics as The Gentlemen.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
ZA
financefinance
Incident Timeline
‎2026/10/05
The Gentlemen, a ransomware-as-a-service group, threatened to leak customer data from top insurance companies in South Africa.
organisation Ransomware
Ransomware group threatens to leak customer data from top insurance companies in South Africa.
organisation Hollard Insurance
The group breached MIP Holdings in June, a South African insurtech company that provides software to some of the country’s largest insurers, including Hollard Insurance .
organisation MIP Holdings
When The Gentlemen breached MIP Holdings, they stole data from numerous other local companies, and now the group is steadily seeking to extort these third-party firms.
Intelligence Sources
Data Breaches 2026-10-05