> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware group threatens to leak customer data from top insurance companies in South Africa - URL: https://f4n6.co.uk/security-feed/ransomware-group-threatens-to-leak-customer-data-from-top-insurance-companies-in-south-africa/ - Published: 2026-10-05T20:40:04.000Z - Updated: 2026-10-05T20:40:04.000Z - Author: Jeff Davies - Tags: #security-feed, The Gentlemen ## 1\. Executive summary The ransomware-as-a-service group calling itself The Gentlemen has threatened to leak customer data belonging to two South African insurance firms, LegalWise and Samwumed, and states that more South African companies will follow. The threat follows the group's June breach of MIP Holdings, a South African insurtech that supplies software to large insurers including Hollard Insurance, and the group is now extorting third-party firms whose data was caught in that intrusion. Hollard Insurance Group is separately listed as a victim on the thegentlemen ransomware leak site. No CVE, CVSS score, or CISA KEV entry is associated with this item: it is an extortion campaign built on data stolen from a shared software supplier, not a software vulnerability. The direct risk to EMEA financial services clients is third-party and supply-chain exposure where a South African insurer, insurtech, or their policyholder data sits in the affected estate, plus reputational and regulatory exposure if that data includes EU or UK data subjects. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | The intrusion originated at MIP Holdings, a software supplier to multiple insurers, and the group is now extorting the downstream firms whose data was held there. | Clients using MIP Holdings or comparable insurtech suppliers must treat this as a third-party ICT incident, confirm contractual notification and audit rights, and assess whether the supplier's controls meet the risk profile. | | DORA Art. 29: preliminary assessment of ICT concentration risk | Multiple South African insurers depend on a single insurtech supplier, MIP Holdings, for software, so one breach exposed several firms at once. | Clients with similar single-supplier dependencies in insurance software should run or refresh a concentration-risk assessment and identify substitutability. | | NIS2 Art. 21(2)(d): supply chain security measures | The threat actor reached LegalWise, Samwumed, and Hollard through data taken from their shared supplier, not through direct compromise of each firm. | In-scope entities must show supply-chain security measures covering suppliers of this type, including security requirements in contracts and monitoring of supplier incidents. | No DORA Art. 17, 18, 19, 24, or 30 row is included: the source does not describe an incident at an EMEA client, an incident-classification decision, a testing programme, or specific contract clauses, so those articles are not engaged by the facts here. UK NIS 2018 is not engaged on the facts available: the affected entities are South African and the source does not identify a UK OES or RDSP. ## 3\. Technical analysis & attack chain The source material does not describe the intrusion technique, exploited component, malware, or tooling. What follows is the sequence of events the sources support, with the gaps stated. 1. In June 2026, The Gentlemen breached MIP Holdings, a South African insurtech company that provides software to some of the country's largest insurers, including Hollard Insurance. 2. During that breach the group stole data belonging to numerous other local companies, not only MIP Holdings itself. 3. The group is now steadily seeking to extort those third-party firms over the stolen data. 4. On or around 2026-10-05, The Gentlemen threatened to leak data belonging to LegalWise and Samwumed, and stated that more South African companies are likely to follow. 5. Hollard Insurance Group is listed as a victim on the thegentlemen ransomware leak site, with country ZA and website hollard.co.za. The pattern is a supplier-centric extortion campaign: the actor compromises one software provider, harvests data belonging to that provider's customers, then runs separate extortion attempts against each downstream firm. This is consistent with the source's statement that the group is "steadily seeking to extort these third-party firms." The sources do not state whether any data has actually been published, whether ransom demands have been paid, or whether the affected firms have confirmed the data belongs to them. **Attribution and confidence.** The Gentlemen is described by the source as a ransomware-as-a-service group and, per Check Point Software cited in that source, accounted for 17% of all ransomware attacks globally in July. That 17% figure is single-sourced to Check Point via the DataBreaches.Net report and should be treated as a vendor estimate, not an independently corroborated statistic. The Gentlemen has no MITRE ATT&CK profile in the verified reference data, so the attribution of this activity to a tracked, profiled actor is unconfirmed. The link between the MIP Holdings breach and the LegalWise/Samwumed threats rests on the DataBreaches.Net report and its My Broadband source; it is single-sourced and should be verified before it is used to drive enforcement or contractual action. **What is not in the sources.** No initial access vector, no exploited CVE, no malware family, no command-and-control infrastructure, no persistence mechanism, no lateral-movement detail, no exfiltration method, and no file hashes or network indicators. Do not assume ransomware encryption occurred: the sources describe data theft and leak threats, not encryption of victim systems. The word "ransomware" appears in the group's classification, not in a description of encrypted estates. ## 4\. Mitigation & containment The sources give no vendor fix, no patch, and no technical indicators, so the actions below are process and third-party controls, not remediation of a named vulnerability. ### P1 within 24 hours - Identify every supplier relationship with MIP Holdings, and any South African insurer, insurtech, or intermediary in your estate that uses MIP Holdings software. Confirm in writing whether your data or your policyholders' data was held in the MIP Holdings environment. - If you hold data on LegalWise, Samwumed, or Hollard policyholders, treat that data as potentially exposed and start a data-subject impact assessment now, before any leak is confirmed. - Ask affected suppliers for their incident timeline, the data categories involved, and whether they have received a ransom demand. Record the answers with timestamps. ### P2 within 72 hours - Review contracts with insurtech and software suppliers for breach-notification windows, audit rights, and data-return or deletion clauses. Where notification windows are absent or longer than your regulatory reporting obligations allow, flag for renegotiation. - Run a concentration check: list any supplier whose compromise would expose more than one business line or more than one legal entity, and record the result. - Brief your incident-response and legal teams on the supplier-centric extortion pattern so that a leak-site listing of a supplier is treated as a potential incident at your firm, not only at the supplier. ### P3 within 7 days - Refresh supply-chain security requirements for software suppliers in line with NIS2 Art. 21(2)(d) where you are in scope, and confirm the requirements are reflected in current contracts. - Add the thegentlemen leak site to your third-party monitoring so that new victim listings are picked up and triaged against your supplier list. - Where a supplier cannot confirm the scope of exposed data, escalate through DORA Art. 28 third-party risk governance and document the residual risk. ## 5\. Indicators of compromise No atomic indicators of compromise (hashes, domains, IP addresses, file paths, registry keys) are present in the source material. The only machine-pivotable artefact is the leak-site victim listing. | type | value | confidence | source | | ------------------------ | --------------------------------------------------------- | ---------- | ----------------------------------------------------- | | leak-site victim listing | thegentlemen: Hollard Insurance Group (ZA), hollard.co.za | medium | ransomware.live | | leak-site victim listing | thegentlemen: LegalWise (ZA) | low | DataBreaches.Net (threat only, not confirmed listing) | | leak-site victim listing | thegentlemen: Samwumed (ZA) | low | DataBreaches.Net (threat only, not confirmed listing) | ```iocs leak-site-victim thegentlemen Hollard Insurance Group ZA hollard[.]co[.]za leak-site-victim thegentlemen LegalWise ZA leak-site-victim thegentlemen Samwumed ZA ``` The Hollard listing is corroborated by ransomware.live. The LegalWise and Samwumed entries are threats reported by DataBreaches.Net and are not confirmed leak-site listings; treat them as low confidence. ### Behavioural indicators | behaviour | where to observe | confidence | | ----------------------------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------- | | Supplier breach followed by extortion of the supplier's customers | Third-party incident notifications, supplier breach reports, leak-site monitoring | medium (single-sourced pattern) | | Leak-site victim listing naming a supplier's downstream customers | thegentlemen leak site, third-party risk monitoring | medium | ## 6\. Detection The sources contain no file hashes, command-line flags, mutex names, scheduled-task names, service names, file paths, registry keys, ransom-note text, or hard-coded values. There are no threat artefacts from which to build a YARA rule, and no log or behavioural indicators specific enough to build a Sigma rule that would match anything beyond generic supplier-breach activity. Insufficient indicators to author detection rules. ## 7\. Sources - DataBreaches.Net, "Ransomware group threatens to leak customer data from top insurance companies in South Africa", https://databreaches.net/2026/10/05/ransomware-group-threatens-to-leak-customer-data-from-top-insurance-companies-in-south-africa/, 2026-10-05. - ransomware.live, "Ransomware: thegentlemen named Hollard Insurance Group (ZA)", https://www.ransomware.live/id/SG9sbGFyZCBJbnN1cmFuY2UgR3JvdXBAdGhlZ2VudGxlbWVu, accessed 2026-10-05. - My Broadband (cited by DataBreaches.Net as the underlying report; not independently retrieved for this advisory). ## 8\. Adverse Trace position Adverse Trace assesses this as a third-party data-extortion campaign with no software vulnerability component, so the severity for EMEA financial services clients depends entirely on whether they hold data in the affected South African insurance estate. The attribution to The Gentlemen is unconfirmed against MITRE ATT&CK, which has no profile for the group, and the link between the MIP Holdings breach and the LegalWise and Samwumed threats is single-sourced to DataBreaches.Net and My Broadband; we will not treat it as established until a second source or the affected firms confirm it. The 17% global attack share attributed to the group is a Check Point estimate cited by that single source and should not be used as a planning figure. We will monitor the thegentlemen leak site for new victim listings, watch for confirmation from LegalWise, Samwumed, Hollard, or MIP Holdings, and update this advisory if data is published or if the supplier link is corroborated. Clients with South African insurance exposure should complete the P1 supplier identification step before treating this as contained. --- [Read the original source →](https://databreaches.net/2026/10/05/ransomware-group-threatens-to-leak-customer-data-from-top-insurance-companies-in-south-africa/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*