Two controls decided how badly Land Bank was hurt by ransomware this year: what it exposed to the internet, and how the network behind that exposure was divided. On 4 March 2026, answering written question NW385 in Parliament, the Minister of Finance confirmed that attackers “gained access through a vulnerability on an internet-facing server” on 12 January 2026, and that the bank’s ERP, core banking and CRM systems were not accessed because they sat in a separate technical environment. For boards of regulated South African firms, that reply is more useful than most threat reports, because it describes a real incident in the victim’s own words.
What did the Land Bank reply actually disclose?
The reply is short and factual. Set out in sequence, it says:
- Initial access. A ransomware-as-a-service group exploited a vulnerability on an internet-facing server on 12 January 2026.
- Impact. Ransomware encrypted part of the server environment and several laptops. Files on the file server included board and committee documents, corporate governance records and human resources records.
- Containment. The ERP, core banking and CRM systems were not accessed, because the SAP environment was technically separate from the rest of the servers.
- Ransom. The attackers asked for 5 Bitcoin, which the reply put at approximately R5.4 million. The bank decided not to pay and confirmed that no payment was made.
- Notifications. The Information Regulator was notified on 16 January, SAPS on 17 January, the Prudential Authority on 29 January and the State Security Agency on 9 February.
- Remediation. Immediate steps included isolating the environment, patching the vulnerability and hardening firewalls. The board approved medium-term security improvements, most of them due within six months.
None of this is exotic. That is the point. The entry route was a known class of weakness on an exposed server, and the thing that limited the damage was an architectural decision taken long before the attack.
Why are internet-facing systems the first thing attackers test?
An internet-facing system is any server, application or device that can be reached directly from the public internet: VPN gateways, remote desktop services, web portals, file transfer services, email gateways and firewall management interfaces. Together they form the organisation’s external attack surface.
Attackers test this surface first because it requires no phishing, no insider and no luck. Automated scanning identifies exposed services and matches them against published vulnerabilities. If one is unpatched, the attacker has a way in that does not depend on anyone in the organisation making a mistake that day.
The difficulty for most mid-market organisations is not patching. It is knowing what to patch. In our experience, few firms can produce a complete, current list of their internet-facing assets. The usual gaps are predictable: an old test server that was never decommissioned, a remote access tool installed by a supplier, a legacy client portal that still runs on a separate host, a firewall whose management page was opened “temporarily” years ago.
How did segmentation limit the damage?
Network segmentation is the practice of dividing an IT environment into zones with controlled, monitored paths between them, so that compromising one zone does not automatically grant access to the others.
The reply does not describe Land Bank’s architecture in detail, and it would be wrong to infer more than it says. What it does say is enough. The systems that hold customer and financial records were in a separate environment, and the attackers did not reach them. The systems that were reached, a file server and laptops, held governance and HR records.
Many South African mid-market firms run what is effectively a flat network: user devices, file shares, the practice or policy administration system, and sometimes the backups, all on one domain with broad internal access. In that design, a single compromised server or laptop can be a path to everything. Separating crown-jewel systems is an enterprise architecture decision, not a product purchase, and it is one of the few controls that still works after prevention has failed.
What did the incident still cost?
Segmentation protected the core, but the reply is clear that board papers, governance records and HR records were on the file server. HR records typically include identity numbers, banking details and, often, health and disciplinary information, which POPIA treats with particular care.
That is why notification mattered. Section 22 of POPIA requires a responsible party that has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person to notify the Information Regulator and, in most cases, the affected data subjects, as soon as reasonably possible after discovery. Land Bank notified the Regulator four days after the incident date. Since 1 April 2025, the Regulator accepts these notifications only through its eServices portal, so the person responsible needs access to it before an incident, not during one.
What should a regulated firm check against its own environment?
Five questions are worth putting to management this quarter:
- Do we have a complete inventory of internet-facing systems, including those managed by suppliers?
- When was each of them last tested from the outside, by someone independent of the team that built it?
- If our main file server were encrypted tomorrow, which other systems could the attacker reach from it?
- Where do board packs and HR records live, and who can access them?
- Who would notify the Information Regulator, through which channel, and who decides on notifying clients?
If any answer is “we think so” rather than “here is the evidence”, that is the finding.
What to do this quarter
- Map the external attack surface. Build an inventory of every internet-facing asset, including supplier-managed services and cloud-hosted applications.
- Test it independently. Commission an external penetration test of that inventory, and repeat it after significant change.
- Remove what does not need to be exposed. Put remote access behind multi-factor authentication and retire legacy portals and test servers.
- Separate the crown jewels. Identify the systems that hold client, financial and special personal information, and restrict the paths into them.
- Move sensitive records off general file shares. Board packs and HR files belong in access-controlled repositories, not on a shared drive.
- Prepare notification. Confirm who holds eServices portal access, and pre-draft the list of regulators, insurers and clients you would need to inform.
- Test a restore. Prove that offline or immutable backups can be restored within the time the business can tolerate.
Frequently asked questions
How did attackers get into Land Bank’s systems?
According to the Minister of Finance’s reply on 4 March 2026, a ransomware-as-a-service group gained access through a vulnerability on an internet-facing server on 12 January 2026. It then encrypted part of the server environment and several laptops.
Does network segmentation really stop ransomware?
Segmentation does not stop an attacker getting in, but it limits how far they can travel once inside. Land Bank’s ERP, core banking and CRM systems were not accessed because they sat in a separate technical environment, which is the outcome segmentation is designed to produce.
Who must a South African organisation notify after a ransomware attack?
Where personal information may have been accessed or acquired by an unauthorised person, section 22 of POPIA requires notification to the Information Regulator and, in most cases, the affected data subjects, as soon as reasonably possible. Regulated entities may also owe notifications to their sector regulator, and a criminal case is normally opened with SAPS.
How often should internet-facing systems be tested?
At minimum annually and after any significant change, with continuous external monitoring in between. An annual test on its own leaves months in which a newly published vulnerability can sit unpatched on an exposed server.
How Rhentech can help
Our cybersecurity audits start where attackers start: with the external attack surface, followed by the internal paths from a compromised device to the systems that matter. Findings are ranked by business impact and mapped to your POPIA obligations, which we cover in more depth in our POPIA compliance guide.
If you are not certain what your organisation exposes to the internet, book a free initial consultation. The consultation costs nothing; audits and penetration tests are paid engagements, scoped to your environment.
Sources
- Minister of Finance, reply to written question NW385 on the Land Bank ransomware incident, 4 March 2026 (Parliamentary Monitoring Group).
- Protection of Personal Information Act 4 of 2013, section 22 (notification of security compromises).
- Information Regulator, eServices portal for security compromise notifications, mandatory since 1 April 2025.
This article is for informational purposes. It does not constitute legal advice. Consult qualified legal counsel for compliance matters specific to your organisation.
Reviewed 20 October 2026.