What Happened
In late February 2026, Standard Bank (standardbank.co.za), South Africa’s largest bank by assets, suffered a major cyberattack by hackers known as Rootboy (also linked to Prinz Eugen), who exfiltrated approximately 1.2TB of sensitive data from internal administrative and document filing systems, including over 154 million rows of customer PII such as full names, ID numbers, addresses, emails, phone numbers, driver’s licenses, passports, account numbers, limited credit card numbers (but not CVVs), employee data, and transactional records; the breach affected Standard Bank and possibly Liberty, with hackers publicly dumping data daily from April 14, 2026, after the bank refused a 1BTC (about R5.4 million) ransom demand. Discovered around March 23, 2026, and publicly escalating by April 17, the incident spared core transactional systems, prompting the bank to notify regulators, enhance fraud monitoring, replace affected cards, and urge clients to update passwords and enable biometrics, amid South Africa’s record 788 breach notifications in Q1 2026.
