Rand Mutual Assurance (RMA) is investigating a possible cyber security breach after receiving an alert unauthorised access to its systems, following claims by a threat actor that it stole 366GB of data from the South African insurer.
The threat actor alleges the stolen data includes 1.68 million claims records and 593 786 files. It is demanding $95 000 (R1.5 million) in ransom, with a 5 November deadline before the data is allegedly released.
However, RMA has not confirmed a breach, or established whether any information was accessed, acquired or disclosed without authorisation.
In a statement sent to ITWeb, RMA says it received an alert a possible systems breach on Friday, 23 October, and that specialist teams were investigating the matter.
“We are aware of a cyber security alert that is under investigation. Our specialist teams are assessing the circumstances and determining whether any information or systems have been affected. At this stage, the investigation is ongoing,” the company says.
RMA adds that the investigation was aimed at determining the nature and extent of the incident, including whether there had been unauthorised access to information.
“This has not yet been established,” it says, referring to whether personal information may have been accessed, acquired or disclosed without authorisation.
The insurer says it was also assessing whether any personal information had been affected and, if so, which individuals might be affected and what information may have been involved.
“We will communicate once the investigation has established the facts.”
Claims data raises concerns
Dark Web Intelligence, which monitors underground cyber crime activity, reported the alleged incident on X, citing claims made by a threat actor on an underground forum.
According to the post, the actor claims to have obtained 1 683 810 claims records and 593 786 files, amounting to 366GB of data.
Dark Web Intelligence cautions that the allegations remain unverified and do not constitute confirmation of a breach.
Compensation claims can contain sensitive personal information, including identity numbers, medical details and banking information.
If exposed, such information could be used for identity fraud, financial scams and targeted phishing attacks.
RMA handles compensation related to workplace injuries and occupational diseases, making the security of claims information particularly important.
The investigation will determine whether the alleged data theft occurred and whether any personal information was compromised.
RMA says it will verified information as appropriate as the investigation progresses.
The alleged RMA incident follows other cyber security concerns involving companies in the sector, including MPI, Guardrisk and Hollard.
This, as South Africa’s insurance sector has faced a series of cyber security incidents involving insurers and third-party service providers, highlighting the risks posed by attacks targeting sensitive customer and claims data.
Such incidents are particularly concerning because insurance records can contain personal information, medical details and financial data that criminals could exploit for fraud and targeted scams.
The trend was highlighted by the June 2026 cyber security incident at MIP Holdings, a technology provider to the insurance sector, which said personal information linked to customers of 45 South African insurance companies may have been compromised.
The ransomware group The Gentlemen subsequently made claims involving Hollard, but the insurer said there was no evidence its own systems had been compromised and attributed the allegations to the MIP incident.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
