Land and Agricultural Development Bank of South Africa

Summary

The Land and Agricultural Development Bank of South Africa experienced a ransomware attack in which attackers demanded a $3.1 million payment for decryption keys; the institution refused to pay and took several internal IT systems offline as a precaution. While the website remained inaccessible, the bank continued to serve clients through relationship managers and confirmed that banking details and insurance terms were unchanged. Internal IT teams, assisted by external cybersecurity specialists, worked to restore systems, and after a period of disruption the website and digital platforms were brought back online with enhanced security measures in place. A forensic investigation into the attack remained ongoing, and no details of the perpetrators were disclosed.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In January 2026 the Land and Agricultural Development Bank of South Africa experienced a ransomware attack carried out by an external party. The attackers demanded a ransom of $3.1 million, which the bank refused to pay. As a precautionary measure the bank temporarily shut down certain internal IT systems to protect its operations and sensitive information. The shutdown affected both the bank and its subsidiary, Land Bank Insurance Company, causing temporary interruptions to some services and transactions. The bank’s website remained offline following the incident.

During the period of disruption the bank assured clients that it remained open for business through its relationship managers, noting that operations were not dependent on the website. Clients were urged to change passwords and monitor their accounts for any unauthorized activity. The bank’s insurance division confirmed that banking details and terms remained unchanged despite the attack. The Department of Agriculture publicly reaffirmed the bank’s key role in the agricultural sector. While some banking services were impacted, the bank stated it remained focused on safeguarding its operations and the interests of its clients.

The response was overseen by senior leadership including Chief Executive Officer TM Rikhotso, Chief Financial Officer KH Mukhari, and the board of directors. Internal IT teams, supported by external cybersecurity specialists, were deployed to assess the situation and restore systems. A forensic investigation into the attack was initiated and remained ongoing, with no details disclosed publicly. By April 2026 the bank announced that its website was fully restored following the implementation of enhanced security measures. The bank thanked stakeholders for their patience and continued trust during the restoration process.

Sources

Sources available to members: 3 sources.