Ransomware gang threatens to dump more South African client data

The Gentlemen ransomware group, behind the June breach at software supplier MIP Holdings, has added three more South African organisations to its dark web leak site: LegalWise, Samwumed and Edcon. Countdown timers expire on 9 October; only LegalWise has confirmed involvement in the MIP incident. About 400,000 records from roughly 45 insurers were taken from MIP's Jira platform.

• The Gentlemen listed LegalWise, Samwumed and Edcon with timers expiring 9 October
• About 400,000 records from ~45 insurers were taken from MIP's Jira platform
• MIP paid a ransom, yet Hollard data was still published on 7 September
• Check Point Research: over 400 public victims, 2nd most active ransomware group in 2026