Short answer
Rand Mutual Assurance said on 23 October 2026 it had received a cyber security alert that is under investigation. A threat actor claims to have stolen 366GB, including about 1.68 million claim records, and says it will release them after 5 November unless paid US$95,000. RMA has not confirmed any data was taken.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Rand Mutual Assurance |
|---|---|
| Incident type | Data breach |
| Status | Claimed by attackers, unconfirmed |
| Sector | Insurance (workers' compensation) |
| Country | South Africa |
| Detected | 2026-10-23 |
| Disclosed | 2026-10-23 |
| People or records affected | Claimed: 1.68 million claim records and 593,786 files (366GB); unverified |
What data was exposed
- Claimed: workers' compensation claim records
- Possibly ID numbers, medical details on injuries and illnesses, and bank details (typical contents of such claims, not confirmed)
What is claimed
TechCentral reported on 23 October 2026 that a hacker says it stole data from Rand Mutual Assurance, a South African insurer founded in 1894 that handles compensation for workplace injuries and diseases in the mining, iron, steel and metal industries. The actor says it took 366GB, including 1.68 million claim records and 593,786 files.
ITWeb puts the claim at 1,683,810 records. The claim was reported on X by Dark Web Intelligence, an account that monitors underground forums, which described it as unverified. The outlets we opened do not name the actor.
What RMA has said
RMA’s chief information security officer, Nduduzo Majozi, told TechCentral that RMA had received an alert about a breach and that investigations are under way. The company told ITWeb: “We are aware of a cyber security alert that is under investigation.” It said it will communicate “once the investigation has established the facts.”
That wording does not confirm any theft and does not address the ransom demand.
Why people are worried
Claims files for injured workers tend to hold sensitive material. ITWeb notes such files can include identity numbers, medical details and banking information, and that exposure could enable identity fraud and targeted phishing. Whether any of it was taken here is the open question.
Timeline
- 23 October 2026: RMA receives the alert, per ITWeb. The claim reaches the press the same day.
- 27 October 2026: ITWeb reports that RMA has not confirmed a breach.
- 5 November 2026: Deadline the actor has set for payment.
What is still unknown
- Whether data was taken, and which systems were involved.
- How many people have records in any stolen files.
- Whether RMA has notified the Information Regulator. ITWeb’s article does not mention it.
The coverage places the claim among other recent incidents in South Africa. ITWeb points to the June 2026 incident at insurance technology provider MIP Holdings, and TechCentral to a separate claim against pathology group Ampath. See our write-up of the Ampath incident for how a claimed record count can differ from a confirmed scope.
If you have a claim with RMA, treat unexpected contact about it with suspicion. Our guides on phishing messages and urgent payment scams explain the usual tricks, and what to do after a data breach gives the general steps. More cases are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Scam calls or messages to injured workers or former miners who quote a claim number or ID number and ask for bank details to 'release' a payout.
- Fake compensation or medical-report emails with links or attachments.
- Extortion messages from people claiming to hold your medical file and demanding payment.
What to do if you are affected
- 01Wait for RMA's own update and be wary of messages about your claim that arrive unprompted. RMA says it will communicate once the facts are established.
- 02Never give banking details, ID copies or one-time PINs to a caller about a compensation payout. Contact RMA using details from its official website.
- 03Do not pay or reply to anyone claiming to hold your data. Keep the message and report extortion to the South African Police Service.
- 04Consider free Protective Registration with the Southern African Fraud Prevention Service (SAFPS) and check your credit report.
- 05You can raise a complaint with South Africa's Information Regulator if you believe your personal information has been mishandled.
Frequently asked questions
Has Rand Mutual Assurance confirmed a data breach?
No. RMA has said it is aware of a cyber security alert that is under investigation. It has not confirmed that information was accessed, taken or published.
What are the attackers demanding?
The actor demands US$95,000 (about R1.5 to R1.6 million) by 5 November 2026, after which it says it will release the data. This is a claim. TechCentral has not seen the forum post or sample data, and ITWeb puts the sum at about R1.5 million.
Does 1.68 million records mean 1.68 million people?
Not necessarily. TechCentral notes a record count is not a count of people, as in the similar claim against pathology group Ampath.
What data could a compensation claim contain?
TechCentral and ITWeb both say such claims can include identity numbers, medical details and banking information. Whether this was in any stolen files has not been established.
Sources
- Rand Mutual Assurance data breach claim, TechCentral, 2026-10-23
- Rand Mutual probes alleged breach of 1.68m claims, ITWeb, 2026-10-27
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.