Gauteng Provincial Government Hit by Massive Ransomware Breach Exposing 3.8TB of Citizen Data A newly emerged ransomware group, XP95, has leaked 3.8 terabytes of sensitive data stolen from the Gauteng Provincial Government, exposing millions of personal records. The breach, confirmed by threat intelligence firm Darknotify, includes 3,673,556 files among them high-resolution ID documents, passports, and CVs likely belonging to job seekers who submitted applications to the province. The attackers, operating under a Ransomware-as-a-Service (RaaS) model, have demanded $25,000 (R417,300) for the return of the data. To validate their claim, they released a 1.8GB sample of the stolen files on the dark web. Gauteng Premier Panyaza Lesufi acknowledged the breach, stating that internal security protocols had been activated, while spokesperson Elijah Mhlanga urged against speculation. Forensic analysis by Darknotify revealed the breach likely originated from an unsecured, internet-facing scanner server a critical oversight that bypassed the need for phishing or social engineering. The incident underscores a deeper systemic failure: 70% of Gauteng’s network devices (1,734 units) had reached end-of-service (EOS), and its core infrastructure hit end-of-life in December 2024, leaving it vulnerable for over a year. South Africa faces an average of 2,145 cyberattacks per week, making such breaches statistically inevitable. However, the root cause extends beyond technical neglect. Bureaucratic inefficiency, particularly reliance on the State Information Technology Agency (Sita) for IT procurement, has left departments trapped with outdated systems. Meanwhile, the Gauteng government has prioritized high-profile projects such as CCTV surveillance, drones, and a panic-button app over fortifying its digital backbone, expanding its attack surface without addressing core vulnerabilities. The breach follows a pattern of state cybersecurity failures in South Africa, including attacks on City Power, the Department of Justice, and the National Health Laboratory Service. While Gauteng’s exposure of citizen data is severe, the compromised server was isolated not tied to critical infrastructure like treasury systems or power grids. Experts warn that without urgent upgrades, a more targeted attack could have far graver consequences. The incident reveals a perfect storm of neglect: obsolete hardware, misallocated budgets, and a severe shortage of cybersecurity talent, with only one in three public sector cybersecurity roles filled. Gauteng’s breach may have been a near-miss, but the underlying weaknesses remain unaddressed.