N4ughtySec

Overview

N4ughtySec first appeared publicly in March 2022 under the alias N4ughtySecTU when it claimed responsibility for a breach of TransUnion South Africa — one of the country's major credit bureaus. The initial access method was straightforward and embarrassing for the target: the group brute-forced an SFTP server belonging to one of TransUnion's clients whose account was protected by the literal password "Password." From this foothold the group claimed to have exfiltrated 4TB of data and up to 54 million records.

The confirmed scale of the breach was substantially smaller than claimed. TransUnion's own investigation found that data relating to approximately 5 million consumers was potentially affected by the incident, with a further 5.2 million consumers having only their ID numbers exposed. The company also stated that 54 million records claimed by the group were largely drawn from separate data breaches dating back to 2017 that the group had combined with whatever TransUnion data they actually accessed. South Africa's Information Regulator separately criticized TransUnion's breach response as inadequate under the Protection of Personal Information Act (POPIA).

TransUnion's position on the $15 million extortion demand was public and principled: paying would set a bad precedent, incentivize further attacks, and provide no guarantee the data would not be published anyway. When the deadline passed without payment, N4ughtySecTU posted the data online and apparently went quiet. This pattern — breach, demand, non-payment, data release, disappearance — is characteristic of hacktivist extortion operations that are more motivated by the public statement than by financial return.

The group then operated a secondary extortion scheme targeting companies whose data appeared in the TransUnion breach — demanding "insurance fees" from third parties in exchange for exclusion from the data publication. This dual-track extortion model (paying the primary target for non-publication and simultaneously monetizing from data subjects' associated organizations) is a sophisticated escalation from single-target ransomware.

In November 2023, a group identifying as N4aughtySecGroup — assessed as the same entity or a continuation operating under a new alias — re-emerged demanding $30 million each from TransUnion and Experian, claiming it had maintained persistent access to both credit bureaus since the 2022 breach. In 2024, the group made more expansive claims: that it had used credit bureau backend access to penetrate South African banks (Absa, FNB, Nedbank, Discovery, TymeBank), fraudulently registered over 100,000 Social Relief of Distress grant accounts at SASSA by opening mule bank accounts using stolen credit bureau identity data, and extracted approximately R175 million. The group simultaneously claimed to have over 80 access points across government and financial backend systems.

All named banks denied evidence of breaches in their own systems. TransUnion, Experian, and XDS each stated they found no evidence of new unauthorized access. SASSA's grant administration head did confirm that SASSA systems had been compromised and acknowledged weaknesses in bank account opening verification — a partial corroboration of the mechanism claimed, if not the full scale. The Democratic Alliance raised the claims in parliamentary proceedings. The group notably dropped financial demands in the 2024 wave, instead demanding only a public apology and acknowledgment of security failures — a shift from extortion toward reputation pressure and reputational activist goals consistent with hacktivist rather than purely criminal motivation.

Target Profile

N4ughtySec's targeting is focused on South African financial and government infrastructure, with credit bureaus as the strategic entry point for downstream access.

• Credit Bureaus (primary entry point): TransUnion South Africa was the confirmed initial target in March 2022. The group has repeatedly claimed sustained access to TransUnion and Experian through 2023 and 2024, and has included XDS as a claimed target in later waves. Credit bureaus are strategically valuable as targets because they hold comprehensive consumer financial data — ID numbers, credit scores, banking relationships, loan balances, addresses — that can be used both for direct extortion and as the foundation for downstream attacks on financial institutions that serve the same consumer base.
• South African Banks: In 2024, the group claimed to have used credit bureau backend access to penetrate five major South African banks: Absa, FNB, Nedbank, Discovery Bank, and TymeBank. The claimed mechanism was using stolen consumer identity data from credit bureau breaches to open fraudulent mule accounts within the banks' systems — exploiting FICA compliance gaps in account opening verification. All named banks denied evidence of breaches in their core banking systems, though Absa acknowledged that the data set presented appeared identical to a set reviewed in 2023, and all confirmed ongoing anti-mule-account monitoring.
• South African Social Security Agency (SASSA): The group claimed to have exploited SASSA's system vulnerabilities — using credit bureau identity data to fraudulently register over 100,000 Social Relief of Distress (SRD) grant accounts at R370 per month, directing payments to fraudulently opened mule bank accounts. SASSA's head of grant admissions confirmed that SASSA systems had been compromised and that weaknesses at three South African banks in FICA compliance made fraudulent account opening easier. The R175 million figure claimed by the group is disputed but the underlying SASSA vulnerability was independently confirmed by Stellenbosch University researchers.
• High-Profile Individual Data — Political and Judicial Targets: The group specifically organized exfiltrated data into categories including political parties, government officials, parliament members, judges, and prosecutors. South African President Cyril Ramaphosa's ID number was released via Telegram as a demonstration of the scope. The CEO of TransUnion was contacted on his personal cellphone using data found in the breach — a demonstration of access to executive personal information.

Tactics, Techniques & Procedures

N4ughtySec's documented TTPs reflect a combination of opportunistic credential exploitation and a sustained multi-year engagement model focused on a single geographic market.

mitre id	technique	description
T1110.001	Brute Force — Password Guessing	The confirmed initial access to TransUnion in March 2022 was a brute force attack against an SFTP server, ultimately succeeding with the password "Password" on a client account. The group reported to BleepingComputer that they did not steal any credentials through phishing or other means — they simply guessed a weak password on an internet-exposed server. This is the simplest possible initial access technique and highlights the exposure created by internet-facing services protected by weak credentials, regardless of how sophisticated the data they serve is.
T1078	Valid Accounts — Client Credential Abuse	TransUnion confirmed that a "criminal third-party obtained access to its South African server through misuse of an authorised client's credentials." The SFTP account compromised belonged to a legitimate TransUnion client — giving the attacker authenticated access to TransUnion's data environment as if they were a legitimate business partner. This framing — the attack was on a client account, not TransUnion's own credentials — is significant: it means TransUnion's own authentication systems functioned as designed; the vulnerability was in a third party's credential hygiene.
T1530	Data from Cloud Storage — SFTP Server Exfiltration	The confirmed exfiltration occurred from an SFTP server — a file transfer service — that TransUnion operated for client data exchange. The group claimed to have exfiltrated 4TB of data. TransUnion confirmed the server was isolated and held limited South African data, with the much larger 54-million-record claim including externally sourced data from prior breaches dating to 2017. The group appears to have aggregated multiple data sources and presented the combination as a single TransUnion exfiltration to maximize the apparent scale of the breach.
T1657	Financial Extortion — Dual-Track Ransom Model	N4ughtySecTU operated a two-track extortion scheme simultaneously. The primary track demanded $15 million from TransUnion not to publish the data. The secondary track — unusual in documented hacktivist operations — offered "insurance fees" to third-party companies whose data appeared in the breach: pay an undisclosed fee and be excluded from the data release. This secondary market for extortion against data subjects rather than just the breached organization represents a sophistication in monetization strategy beyond standard ransomware models.
T1589	Identity Data Weaponization — Downstream Fraud	In the group's 2024 claims, the breach data from credit bureaus was repurposed as the foundation for downstream financial fraud: using stolen identity data to open mule bank accounts, then using those accounts to fraudulently register SRD grant applications at SASSA. This multi-step fraud chain — credit bureau breach → identity data → fraudulent bank accounts → government benefit fraud — demonstrates how comprehensive consumer financial identity data from a credit bureau enables cascading downstream attacks across the financial ecosystem that serves those consumers.
T1491	Public Data Leak — Pressure and Proof of Access	When TransUnion declined to pay, N4ughtySecTU publicly released the stolen data — a standard hacktivist pressure tactic that also serves as proof of the breach's reality. In 2024, the group demonstrated access to current financial data of two MyBroadband journalists (including insurance company and policy number data from recent months) to prove the ongoing currency of their access rather than relying on years-old static data. This demonstration of data recency is a sophisticated proof-of-access technique that distinguishes ongoing system access from one-time historical data sets.

Known Campaigns

Techniques and Methods

N4ughtySec's documented technical methods are relatively basic — the group's impact derives from the sensitivity of the data in weakly secured environments rather than from technical sophistication.

• SFTP Brute Force: The confirmed initial access to TransUnion was a brute force attack against an internet-exposed SFTP server. The group reported to BleepingComputer that they did not steal credentials through phishing or other means — they guessed a weak password ("Password") on a client account. This represents the simplest possible initial access vector and a failure in TransUnion's client security standards rather than a sophisticated attack on TransUnion's own systems.
• Data Aggregation from Multiple Breach Sources: The group's claimed 54-million-record data set appears to have been assembled by combining the actual TransUnion SFTP exfiltration with data from other South African data breaches dating to 2017. TransUnion explicitly stated the 54-million figure included data "from separate data breaches dating back to 2017." This aggregation technique allows the group to present a much larger apparent breach than actually occurred, maximizing pressure on the target.
• Telegram for Communication and Data Release: The group communicates with media and targets through Telegram channels, releasing proof-of-access samples, ransom demands, and ultimately the full stolen data through this platform. Ramaphosa's ID number was posted to a Telegram group chat. Direct communication with journalists occurred via Telegram.
• Identity Data Reuse for Downstream Fraud: The group's claimed 2024 operations describe using comprehensive credit bureau identity data to open mule accounts at South African banks — exploiting FICA compliance gaps in account verification. This downstream weaponization of stolen identity data against the financial ecosystem represents the most serious potential operational capability if the claims are accurate.
• Proof-of-Access Demonstrations: When challenging skepticism about ongoing access, the group demonstrated current financial data for specific journalists — insurance company details, loan balances, and policy information updated within months of the demonstration. This approach proves data recency without revealing operational details and is a technique for maintaining credibility despite institutional denials.

Indicators & Detection Notes

N4ughtySec's confirmed attack vector was a basic credential-based SFTP intrusion. Detection and prevention centers on hardening internet-facing file transfer services.

Mitigation & Defense

The TransUnion breach was preventable with elementary credential security controls on an internet-exposed service. The downstream identity fraud claims — if accurate — are harder to prevent as they exploit systemic gaps in identity verification across South Africa's financial sector.

• Enforce strong password policy on all client-facing API and SFTP accounts: N4ughtySec's entire initial access hinged on the password "Password" being in use on an SFTP account. Any internet-facing service that allows client authentication must enforce minimum password complexity requirements, reject common passwords programmatically, and detect this failure before deployment. TransUnion's client account security standards failed to prevent a client from setting a completely trivial password on an account with access to millions of consumer records.
• Require MFA on all internet-facing file transfer services: SFTP brute force attacks succeed only when credentials alone are sufficient to authenticate. Adding a second factor — even a shared TOTP or certificate-based authentication — eliminates brute force as a viable initial access vector regardless of password weakness.
• Implement IP allowlisting and geofencing for SFTP client accounts: Legitimate business partners accessing SFTP services do so from known IP ranges. Restricting SFTP authentication to pre-approved IP addresses — or alerting on authentication from unexpected locations — would have flagged or blocked the TransUnion access immediately, since the brute force originated from an attacker-controlled IP rather than the legitimate client's infrastructure.
• Monitor for unusual download volume from authenticated SFTP sessions: A client account downloading gigabytes or terabytes of data in a single session is anomalous behavior regardless of credential validity. Data transfer anomaly detection on file transfer services — alerting on sessions that download significantly more data than the account's historical baseline — would have detected the exfiltration in progress.
• Harden FICA account opening verification to prevent identity fraud at scale: The group's 2024 SASSA fraud claims — if accurate — relied on FICA compliance gaps at South African banks that allowed over 100,000 accounts to be opened using stolen identity data without sufficient verification. Strengthening identity verification requirements for new account opening, particularly for accounts in unusual patterns (volume, geography, data source), addresses the downstream fraud vector that credit bureau breaches enable. SASSA's head of grant admissions explicitly confirmed that non-compliant bank account opening practices at three institutions made fraudulent registration easier.
• Treat extortion refusal as the correct policy baseline: TransUnion's decision not to pay the $15 million demand — despite the data being released — is the appropriate industry posture. Paying extortion guarantees that future attackers will target the same organization again with the demonstrated knowledge that payment is possible, while providing no guarantee of non-publication. TransUnion explicitly stated this principle. The group returned in 2023 and 2024 regardless of the non-payment — confirming that payment would not have prevented the ongoing engagement.

Sources & Further Reading

Attribution and references used to build this profile.

• ITWeb — BREAKING: Credit bureau TransUnion hacked (2022, first disclosure)
• BleepingComputer — Hackers claim to breach TransUnion South Africa with 'Password' password (2022)
• CyberScoop — South Africa credit bureau breached, data reportedly held for $15M ransom (2022)
• Daily Investor — Hackers claim they have access to South African citizens' financial data (2024)
• Times Live — Hackers demand $60m from TransUnion, Experian for 'new' SA data theft (2023)
• BizNews — Hacker group claims to have exposed bank data, defrauded Sassa grants (2024)
• TransUnion Newsroom — Update: March 2022 South Africa Cyber Incident (official statement)