DeXpose reports that a ransomware group calling itself TheGentlemen has publicly claimed attacks on three South African local municipalities this year: Witzenberg (claimed on 20 January 2026), Intsika Yethu (15 February 2026) and Elundini (21 March 2026). In each case the group is reported to have threatened to publish stolen data unless the municipality negotiated.
These are claims made by the attackers. The reports we reviewed do not establish what was taken, whether the municipalities have confirmed the incidents, or how the attackers got in, so we make no claim about any individual municipality. Sources: Witzenberg, Intsika Yethu, Elundini.
Our view
Whatever the detail of these cases, they point at the same question for anyone who supplies software or devices to public bodies: what happens to the service when the network around it is compromised?
- Isolation by design. A fines, billing or tracking system should not depend on the same flat network as email and file shares. Segmentation is a design decision made early, not a firewall bolted on.
- Recoverability you have tested. Backups that have never been restored are a hope, not a control. Restore drills belong in the delivery plan.
- Least privilege for people and devices. Field devices, vendor support accounts and administrators should each hold only the access their job needs, with access that can be revoked quickly.
- Data minimisation. Data that is not held cannot be stolen or published. This is also what POPIA expects.
Public bodies are entitled to ask their suppliers these questions, and suppliers should expect to answer them in writing.