Finance Minister Enoch Godongwana has confirmed that the Land and Agricultural Development Bank of South Africa was hit by a ransomware attack earlier this year, with hackers demanding 5 Bitcoin (approximately R5.4 million) in exchange for stolen data.
The Minister revealed this in a parliamentary reply to uMkhonto weSizwe MP Adil Nchabeleng, who had asked him about the nature of the breach, the systems affected, and whether a ransom had been demanded. According to Godongwana, critical banking systems and farmer data were not compromised, thanks to the bank’s swift action in isolating affected systems and strengthening security controls.
Ransomware Attack Details
The Minister said that hackers gained access to the Land Bank’s computer systems through a vulnerability on an internet-facing server and deployed ransomware, which encrypted a portion of the Land Bank server environment as well as multiple laptops. The ransomware targeted servers in virtual server environments running Microsoft operating systems, and the threat actors have been identified as a Ransomware-as-a-Service Group.
The Land Bank immediately isolated affected systems, removed indicators of compromise, and strengthened security controls, including hardening and configuring firewalls and patching vulnerabilities. The bank’s critical ERP, core banking, and customer relationship management (CRM) systems were not accessed, and therefore not compromised by the threat actor, due to the SAP system being in a separate technical environment.
Impact on Land Bank Operations
Although the hackers demanded Bitcoin for the return of stolen data and a promise not to publish it, the Land Bank has taken the decision not to make any ransom payment. The bank’s operations were not significantly impacted, and farmer data remained secure.
Here are some key facts about the ransomware attack:
- Hackers demanded 5 Bitcoin (approximately R5.4 million) in exchange for stolen data
- Critical banking systems and farmer data were not compromised
- The Land Bank isolated affected systems and strengthened security controls
- The bank did not pay the ransom demand
The latest incident comes after other attacks on South African entities, including a major cyber incident at South African Airways last May, which disrupted access to its online platforms.
