Ransom! Guardrisk (SEP-2026)
Guardrisk (South Africa) is a Sandton, Johannesburg-based specialist insurance group and cell captive insurance pioneer, founded in 1993 and operating licensed insurers for life, non-life, and microinsurance, with international cells in Mauritius and Gibraltar; it is wholly owned by Momentum Group since 2013–14. The ransomware claim alleges that the threat actor “thegentlemen” targeted guardrisk.co.za, impacting South Africa. #southafrica

Incident Details

  • Victim: Guardrisk
  • Sector: Financial Services
  • Country: ZA
  • Actor: thegentlemen
  • Source: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/#Guardrisk
  • Discovered: 2026-09-26T08:48:17.963292+00:00
  • Published: 2026-09-21T00:00:00+00:00

Information

  • South African specialist insurance group founded in 1993, recognized as a pioneer and market leader in cell captive insurance in Africa.
  • Headquartered in Sandton, Johannesburg, with licensed insurers for life, non-life, and microinsurance, plus international cells in Mauritius and Gibraltar.
  • Operates a model that lets companies run their own branded insurance businesses using its licensed infrastructure.
  • Employs around 530 people.
  • Wholly owned by Momentum Group since 2013–14 after a R1.6 billion acquisition.
  • For the financial year ended 30 June 2025, managed total assets of R68 billion and over 240 active cells.
  • Generated net revenue of about R2 billion and pre-tax trading profit of about R1 billion.

Disclaimer: This post is based on public claims made by the ransomware group "thegentlemen". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.

monitored by: ransomware.live