A threat actor named express is offering over 14GB of stolen data allegedly from SITA (State Information Technology Agency), which manages infrastructure for the South African Government.
The leak includes:
- Thousands of sysadmin usernames
- MD5 hashed passwords still usable
- Server logs with sensitive information
Pricing
- Data only: $400–$500
- Data + server access (if verified): $1,000–$1,500
A sample was shared, and contact details were posted for direct negotiation.