Insurer Hollard has rejected claims that its IT systems were hacked, saying a threat actor’s allegations stem from a cyber incident at a third-party service provider.
This, after a threat actor called “The Gentlemen” claimed on the dark web that it had compromised Hollard’s systems.
The third-party service provider, MIP Holdings, has since confirmed the breach, which it says happened in June.
MIP Holdings provides policy administration, customer relationship management and related technology to insurers, healthcare providers, lenders, pension administrators and business process outsourcing companies.
The company says it notified affected stakeholders of the cyber attack, in which personal information linked to customers of about 45 South African insurance companies was compromised.
According to a 23 June breach notification signed by MIP Holdings CIO Fergus McLoskey, the company detected a cyber extortion attack on 14 June targeting its third-party Jira project-management platform.
MIP says its core systems and client policy-administration databases were not compromised, but the attackers accessed Jira and certain FTP/SFTP sites using credentials obtained from the platform.
The affected Jira environment contained personal information relating to employees, clients’ users and members/customers, including information visible in screenshots, task attachments and, in some cases, access credentials.
MIP notes its investigation is still determining the precise scope and categories of data affected, and whether information had been downloaded, copied, misused or disclosed.
The company identified the attacker as the ransomware group “The Gentlemen” and says it had received undertakings that unlawfully accessed data had been deleted and would not be published or misused.
MIP also notified the Information Regulator on 16 June under section 22 of the Protection of Personal Information Act (POPIA) and informed the Financial Sector Conduct Authority and Prudential Authority.
‘Gentlemen’ hackers
Emerging in mid-2025, The Gentlemen is a cyber criminal group that breaks into company networks, steals sensitive data and encrypts the victims’ files, says cyber security firm FortiGuard Labs.
It explains that the group then demands a ransom to recover the encrypted files, with the added threat that they will publish the stolen data online if the company refuses to pay – a strategy commonly known as the “double-extortion” tactic.
According to FortiGuard Labs, the group is speculated to be working out of Russian-speaking regions due to a prohibition enforced by the operators against targeting organisations in Russia and other Commonwealth of Independent States countries.
It adds that as of early 2026, the group’s data leak site lists more than 200 victim organisations in over 50 countries, spanning every major continent.
These victims represent over 20 industries, including vital areas such as energy, government and healthcare services.
The Gentlemen publicly advertises its tools on underground criminal forums, operating what looks like a ransomware-as-a-service program and promising affiliates a ‘generous’ 90% cut of the profits.
Calling in the experts
In a statement, Hollard says it is aware of claims made by a threat actor in a post referencing the organisation on the dark web.
“We identified the threat through our proactive threat intelligence capabilities, immediately activated our cyber incident response processes and engaged specialist forensic investigators.”
According to the company, based on the forensic and assurance activities conducted to date, there is no evidence of compromise within the Hollard environment.
“At this stage, the claim appears to be attributable to a June 2026 cyber security incident that affected a third-party, MIP (a service provider to several companies within the insurance sector), rather than to any compromise of Hollard’s systems.
“Protecting the information entrusted to us by our customers, brokers and partners remains a priority. We continue to monitor the situation closely.
“Should any material information emerge that changes our current assessment, we will communicate this promptly through our established incident response channels.”
More victims
LegalWise South Africa and its insurer Legal Expenses Insurance Southern Africa Limited (LEZA) have also issued a statement regarding the MIP cyber incident, saying they are working closely with MIP Holdings, independent cyber security specialists and legal advisers to understand the full scope and impact of the incident.
LEZA has notified the relevant regulatory authorities, including the Information Regulator, as required, and continues to manage the incident in accordance with POPIA and other applicable legal and regulatory requirements.
The National Fund for Municipal Workers has also warned members that some of their personal information may have been accessed in a cyber security incident involving MIP Holdings.
It notes that exposed information could potentially be used for fraud, phishing and other forms of cyber crime.
The fund advises members to be cautious of unsolicited e-mails, links and attachments and not to disclose passwords, PINs, identity or banking information unless they have verified who is requesting it.
It also urges members to use strong, unique passwords, enable multi-factor authentication, keep devices and software updated and monitor their credit profiles for suspicious activity.
Growing third-party risks
Jason Jordaan, principal forensic scientist at DFIR Labs, says cyber attacks against South African organisations are not necessarily a new phenomenon, but their frequency, intensity and visibility have increased.
He notes that ransomware and cyber extortion groups are increasingly publicising successful compromises as part of their extortion tactics, making attacks that may previously have remained private much more visible.
“What has changed, in my view, is both the frequency and intensity of these attacks, as well as the modus operandi of the groups carrying them out,” says Jordaan.
He says the Hollard incident highlights the growing cyber security risks associated with third-party service providers. Hollard has indicated the compromised data originated from a breach involving a third-party that held information about some of its customers.
Jordaan says outsourcing the processing of personal information does not remove an organisation's responsibility to protect that information. “Third-party cyber security risk cannot simply be treated as somebody else’s problem,” he says.
He notes that organisations need to conduct proper due diligence and ensure service providers have adequate security controls.
He warns that third-party providers can become attractive targets because they may hold large amounts of sensitive information belonging to multiple organisations and their customers. This means an organisation can have strong security within its own environment but still suffer a data breach because of weaknesses at a supplier.
“Your security posture is increasingly influenced by the security of every third-party to whom you entrust your information,” says Jordaan.
He points out that the cyber crime group claiming responsibility for the Hollard breach is an established operation that has been tracked by law enforcement and cyber security organisations. He says available intelligence indicates possible links to a Russian-speaking territory, although this does not establish where the individuals behind the group are physically located.
He says the group’s previous activity and technical capabilities mean its claims should not be dismissed without investigation. “I would certainly take the threats made by this group seriously.”
Share
