The Development Bank of Southern Africa, a state-owned development finance institution that funds infrastructure and education projects, said it was hit by ransomware on or about May 21, 2023. The bank published a notification of security compromise in mid-June setting out what had happened and what data was involved.
DBSA attributed the attack to Akira, a ransomware operation that had emerged only weeks earlier, while cautioning that the attribution was not definitive because the investigation was still running. The attackers encrypted servers, log files and documents, and threatened to publish the stolen material on the dark web if a ransom went unpaid.
According to the bank's notice, the compromised information included business names, the names of directors and shareholders, physical addresses, identification documents and national identity numbers, telephone and mobile numbers, email addresses, details of commercial or employment relationships with DBSA, and financial information relating to stakeholders.
DBSA said it had restored its information systems, removed the ransomware, revoked third-party access and appointed a forensic investigator, which was running daily dark web searches to establish whether the data had been published. The bank engaged law enforcement and regulators including South Africa's Information Regulator, and said no additional protective steps were immediately necessary for stakeholders beyond staying alert to attempted misuse of their information, such as impersonation.