OpSouthAfrica Explained: The Nullsec Nigeria Hack Claims Investigated

In the second half of May 2026, a Nigerian hacktivist crew called Nullsec Nigeria claimed to have breached nine South African government agencies in a single week: SARS, SITA, the Department of Correctional Services, SACAA, SANSA, SASSA, the Department of Human Settlements, the National Housing Finance Corporation, and Ephraim Mogale Local Municipality. The hashtag was #OpSouthAfrica. The distribution channels were the dark-web forum Breached, a branded Telegram channel, and amplification through X.

SARS denied it within hours, and SITA followed with a statement more technically detailed than most South African agencies manage when they have a real incident to contain. Independent researchers who examined the published file structures found the payload consistent with recycled infostealer logs, not a direct network compromise of either agency. On the available evidence, the SARS and SITA claims are almost certainly inflated.

The credentials in that dump came from somewhere. They still work wherever the same passwords were reused. Your organisation's exposure depends on how many of your staff or suppliers were in that data, and most South African businesses have no way of knowing right now.

What the evidence shows about the OpSouthAfrica breach claims

The crew published their claims in stages between 17 and 25 May, staging each release for maximum media coverage. Three other handles appeared in subsequent reporting alongside Nullsec Nigeria: 404 Crew, Infernalis, and Nullsec Philippines. None of the three have verifiable independent histories in the SA context. The most credible reading is that these are the same operation under different names, or amplification accounts added to give the campaign a coalition appearance.

Campaign timeline

What Nullsec Nigeria claimed: target-by-target analysis

The most significant claim was a dump from SARS and SITA published between 23 and 25 May, purporting to contain names, email addresses, and cleartext passwords from the eFiling platform. Two things make that claim technically implausible. Modern login systems store password hashes, not plaintext passwords. Cleartext credentials in a dump almost always originate from infostealer malware running on a user's personal device, not from a server-side breach.

Why OpSouthAfrica matters beyond the government agencies named

I have spent more than twenty years running security assessments for South African organisations. The pattern at the centre of OpSouthAfrica is one I see consistently: the claim is about a government breach, but the underlying risk lands in the private sector.

Infostealer malware does not breach government servers. It runs silently on a personal laptop, harvests every saved browser password in under a minute, then disappears. The person whose credentials ended up in a Nullsec dump may have logged into eFiling from a home computer that downloaded cracked software two years ago. That credential sat in a broker's database, was bundled with thousands of others, and was eventually repackaged as part of a hacktivist claim for the news cycle. The underlying credential still works anywhere the same password was reused.

The DCS procurement sample adds a second concern. The dominant attack workflow against SA government and parastatal portals is to crawl public URLs, increment sequential record IDs, query API endpoints directly, and bundle whatever comes back. Access controls are enforced at the user interface layer. The underlying API returns records to anyone who knows the URL structure. In every portal audit I have run over the past three years, at least one of these exposure patterns was present.

What South African organisations should do right now

• Check your domains against infostealer log databases. Have I Been Pwned offers free domain-wide monitoring. Commercial services cover the dark-web marketplaces the free tools do not reach. Any staff email address flagged in a stealer log should trigger an immediate forced password reset through your identity provider.
• Audit MFA coverage beyond the obvious accounts. Most SA organisations have MFA active on Office 365 admin and banking. The credential supply chain targets the gaps: CRM platforms, accounting software, supplier portals, and personal mailboxes connected to work calendars.
• Test your public portal for IDOR vulnerabilities. Find every URL in your portal that contains a numeric ID parameter. Increment the number. If you get back data belonging to someone else's record, that is a critical vulnerability fixable in under a day.
• Draft your POPIA Section 22 response template now. Agree in advance who confirms facts internally, who contacts the Information Regulator, and who briefs affected data subjects. SARS and SITA's same-day named-spokesperson denials reflect exactly this kind of preparation.
• Set up dark-web monitoring for your organisation's name and domains. Keyword alerts on Breached, BreachForums, and relevant Telegram channels mean you find out about a claim before a journalist emails you for comment.

Where Ubuntu Guard fits

Ubuntu Guard provides credential exposure audits, procurement portal hardening reviews, and POPIA dry-run exercises for South African businesses and organisations. If OpSouthAfrica raised questions your security team cannot yet answer with confidence, those are the conversations we work through with clients.

Reach us at [email protected]

Frequently asked questions