Cyber Incident Victim: University of Limpopo
Date:
May 2016
Location:
South Africa
Summary
New World Hackers, affiliated with Anonymous’ #OpAfrica campaign, breached a South African university’s systems, defacing its website and exfiltrating sensitive data. The attackers leaked exam papers, promotional materials, personal details of over 18,500 current students and 16,300 alumni—including names, birth dates, academic records, and student numbers—along with internal faculty phone numbers and administrative credentials in both hashed and cleartext forms. The group criticized the institution’s cybersecurity practices, asserting that vulnerabilities in its website code facilitated the intrusion, and indicated plans for additional data releases as part of their ongoing campaign.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On May 13, 2016, the New World Hackers (NWH), a group affiliated with the Anonymous collective’s #OpAfrica campaign, breached the University of Limpopo’s website in Polokwane, South Africa. The attackers defaced the site with messages promoting #OpAfrica’s principles and criticizing the university’s administrators for poor security practices. The defacement was removed shortly after discovery, but the university’s website remained inaccessible as of May 15. NWH member SinfulHazeCE claimed responsibility for the intrusion, which involved exploiting vulnerabilities in the website’s code. The group publicly chastised the institution, stating, "A university has experts who should know how to secure a website... They should know not to code their website with vulnerabilities all over the place."
The attackers exfiltrated and leaked four categories of data through publicly accessible links. A Mega.nz repository contained 1.08 GB of exam papers (1,978 PDF files) and 35 MB of non-sensitive intranet materials like promotional PDFs and PowerPoint presentations. Separately, they released personal details of 18,545 current students—including full names, dates of birth, academic departments, student numbers, and enrollment years—and 16,383 alumni records with similar identifiers plus gender. A fourth leak exposed 1,700 faculty phone numbers, some already publicly available. Additionally, administrative credentials (both hashed and cleartext passwords) were compromised. NWH announced plans for further #OpAfrica-related data dumps in subsequent weeks. The breach disrupted university operations by forcing the website offline and exposed sensitive student information, though no institutional response or containment measures were detailed in available reports.