Ransomware Group Threatens Data Leak from South African Insurance Firms

• •The Gentlemen ransomware group threatens to leak data from LegalWise and Samwumed.
• •63% of ransomware incidents in South Africa resulted in data encryption over the past year.
• •Average recovery costs for South African firms hit R17 million, excluding ransom payments.

The ransomware group known as The Gentlemen has threatened to leak customer data from South African insurance companies LegalWise and Samwumed. This group is recognized as a significant player in the ransomware-as-a-service model, accounting for 17% of global ransomware attacks in July 2026. The threat comes amidst a broader context of increasing ransomware incidents in South Africa, where organizations are facing rising recovery costs averaging over R17 million. The Sophos report indicates that 63% of ransomware attacks in the past year resulted in data encryption, with compromised credentials being the leading cause. As ransomware attacks escalate, organizations are improving recovery methods, with 99% recovering encrypted data. However, the proportion of victims paying ransoms has decreased from 71% to 58%. The situation remains critical as the threat of data leaks looms over affected companies.