Rand Mutual Assurance (RMA) is investigating a claimed data breach. RMA is the 130-year-old South African mutual that runs workers' compensation for the mining, iron, steel and metals industries. An extortion actor says it has stolen 366GB of data, including about 1.68 million compensation claim records and 593,786 files. It is demanding a ransom of roughly US$95,000 to US$98,000, depending on the report. RMA's group CISO, Nduduzo Majozi, has confirmed that the company "has received an alert about a data breach" and that "investigations are under way". The company has not confirmed that any data was taken. It has not addressed the ransom demand, and nobody has independently verified the dataset. What is confirmed so far is the investigation, not the theft.
What Happened
The claim first appeared on an underground forum. On 23 October 2026 it was flagged by Dark Web Intelligence, an X account that tracks such forums and describes the claim as unverified. TechCentral, as reported by eriinfo, says it has not seen the forum post or any sample data.
Sources disagree on who is behind it. eriinfo and Undercode News refer only to an unnamed "hacker" or "threat actor" on a forum. MyBroadband and FemtoSec name the Kazu ransomware group and say RMA appears on Kazu's Tor-based leak site with a countdown timer. Kazu may have both posted on the forum and listed RMA on its leak site, but no source connects the two directly.
The ransom terms also differ:
- Amount: US$95,000 (about R1.6 million) according to eriinfo and Undercode News, citing the forum post. MyBroadband reports US$98,000 (R1.57 million) as the figure Kazu says it sent RMA.
- Deadline: 5 November 2026 according to eriinfo and Undercode News, and 4 November 2026 according to MyBroadband. FemtoSec describes a 12 to 13 day countdown from 23 October, which fits either date.
RMA says it will communicate further once investigations are concluded. Majozi's LinkedIn profile shows he moved into the group CISO role in March 2026 after nearly four years as group CTO.
What Was Taken
Every volume figure comes from the attacker. None has been verified.
- 366GB of data (consistent across all sources)
- 1,683,810 compensation claim records, according to the forum post as relayed by Undercode News and eriinfo. MyBroadband reports "over 1.6 million records". The "168 million" in Undercode News' headline contradicts its own article body and looks like a typo.
- 593,786 files
A record count is not a count of people. eriinfo points to the recent claim of 80 million records stolen from pathology group Ampath. Ampath said that figure referred to database entries, not individual patients. One worker can generate many claim records, and the file count may include duplicates and attachments.
If the data is real, it is highly sensitive. COIDA compensation claims can include national ID numbers, medical reports on injuries and occupational diseases, and bank details for benefit payments. MyBroadband reports that RMA covers more than one million workers. It also pays monthly pensions to permanently injured workers and to the surviving spouses and children of workers killed on the job. Its member employers reportedly include Anglo American, Sibanye-Stillwater, Impala Platinum and Harmony Gold. The people exposed would be largely mine and metals workers and their dependants, a group that is often financially vulnerable and well suited to targeted fraud.
Why It Matters
Medical plus financial plus identity data is the most valuable combination. A dataset that pairs ID numbers, diagnoses and bank details enables identity fraud, payment redirection scams aimed at pensioners, and extortion of individuals over medical conditions.
This is part of a sector-wide pattern. It follows a run of attacks on South African insurers and healthcare companies. That includes the June breach at insurance software supplier MIP Holdings, whose CEO said about 45 client organisations, almost all life insurers, were affected. It also includes the Ampath claim.
POPIA puts the burden on the data owner. The Information Regulator told TechCentral that in the MIP case "the obligation rests on the responsible party", meaning the insurer and not its vendor. RMA is the responsible party for its claimants' data. If the breach is confirmed, the section 22 notification duty falls on RMA. MyBroadband notes that RMA's own POPIA compliance document lists firewalls and other network security controls, which regulators may now examine.
Claims of this size should be treated with caution until confirmed. Extortion actors routinely inflate figures and set deadlines to pressure victims. A deadline does not prove the actor holds the data. Defenders and journalists should wait for sample verification or a statement from RMA before treating the 1.68M figure as fact.
The Attack Technique
How the attackers got in has not been disclosed. RMA has released no technical details.
FemtoSec reports that Kazu runs a double-extortion model using LockBit-derived encryptors for Windows and Linux/ESXi. It says Kazu typically gets in through credentials bought from access brokers, infostealer logs, or vulnerabilities in internet-facing appliances. This is a single, unverified vendor profile of the group, not evidence from the RMA intrusion. It also does not explain the discrepancy over who made the claim.
Recent, unrelated research shows the kinds of techniques that matter here. Neither case is linked to RMA or Kazu:
- EyeR Security, investigating a Qilin affiliate intrusion, found the attacker logged in through a GlobalProtect SSL VPN with valid credentials and no MFA. The attacker exfiltrated data with rclone and read the victim's cyber-insurance policy to set the ransom amount. Plaintext firewall, VPN and SSO credentials stored on a file share sped up lateral movement.
- Atos recovered the toolkit of the Eclipse RaaS group from a leaked C2 server. It included exploits for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849), showing how deliberately groups target backup and virtualisation systems before encrypting.
What Organizations Should Do
- Enforce phishing-resistant MFA on every remote access path. That covers SSL VPNs, VDI and admin portals. Treat credentials found in infostealer logs as already compromised and rotate them before attackers use them.
- Patch and isolate hypervisors and backup consoles. Close known ESXi and Veeam flaws, take management interfaces off general networks, and keep immutable, offline backups whose restores you test.
- Watch for bulk exfiltration. Alert on rclone, MEGAsync and similar tools, on unusually large outbound transfers to cloud storage or VPS hosts, and on bulk access to claims or document repositories.
- Remove plaintext credentials from file shares, scripts and wikis. Move them into a managed vault, and keep internal cyber-insurance and ransomware-response documents away from general staff access.
- Rehearse your POPIA breach response now. Map which systems are run by vendors (operators) and which you control (responsible party). Make sure contracts require vendors to notify you "without undue delay". Prepare section 22 notifications to the regulator and to data subjects in advance.
- Protect claimants and pensioners from follow-on fraud. Any insurer or benefits administrator with exposed members should require out-of-band verification for any change to bank details. Warn beneficiaries about scam calls that use their claim information.
Sources: Rand Mutual Assurance probes claimed theft of claim records - eriinfo | 130-year-old financial provider that works with some of the biggest... | Kazu Ransomware Targets RMA: Threat Analysis & Defense | Rand Mutual Assurance Hit by Alleged 366 GB Data Breach: 168 Millio... | Nduduzo Majozi (MBA) | Insurers carry the can for MIP breach, regulators say | Eclipse ransomware - Tradecraft exposed through a leaked C2 server... | Ransomware C2 Takeover: How an rclone Transfer Gave Root Access on...