Land Bank declines to confirm R50m ransom claim as cyber investigation continues

THE Land and Agricultural Development Bank of South Africa (Land Bank) has declined to confirm or deny reports that cybercriminals demanded a R50 million ransom following a cybersecurity breach last month, saying it will not comment on alleged ransom demands while investigations are ongoing.

- SIPHELELE DLUDLA

This comes after the Land Bank reported a “temporary disruption affecting certain internal IT systems” that occurred on 12 January, after which it took offline the affected systems as a precautionary measure to protect its operations and information.

However, a source close to the situation has claimed that the bank's IT systems were hacked and that the perpetrators allegedly demanded a R50m ransom. It remains unclear whether any ransom was paid.

In an emailed response to BR on Friday, the bank confirmed it experienced a cybersecurity incident caused by an unauthorised third party that deployed ransomware, which encrypted part of our server environment. However, it refused to engage on specific details relating to any possible ransom.

“As a matter of security and investigative protocol, the Bank does not comment on specific aspects of threat actor engagement, including any alleged ransom demands, while the forensic process is ongoing,” the bank said.

While questions remain about whether a ransom was demanded — and if so, how much — the bank has made clear that it will not discuss such matters publicly while investigations are ongoing.

“Our focus remains on system recovery, protecting stakeholders, and supporting law enforcement efforts,” it said.