African National Congress Listed by Black X Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 28 August 2025 the African National Congress was listed by the ransomware group Black X, which claims to have taken internal files during an attack. For party members, staff, volunteers and anyone whose details may sit inside those files, the practical stakes are immediate: personal information could be misused for fraud, targeted harassment or political pressure, and the organisation itself faces disruption of its day-to-day work.

Public detail remains limited. The number of people affected is unknown, and the precise contents of the files have not been independently confirmed. What is known is the claim itself and the nature of the organisation involved.

What happened

According to the available record, the African National Congress was listed by the Black X ransomware group on 28 August 2025. The listing states that internal files were exfiltrated in a ransomware attack. No further verified information has been released about the date the intrusion began, the systems involved, the volume of data taken, or whether encryption was also deployed. The number of individuals whose information may be contained in the files is listed as unknown. All specifics beyond the group’s claim remain undisclosed.

The group behind it: Black X

Black X is a ransomware operation that follows the now-familiar double-extortion model used by many contemporary groups. Operators typically gain access to a network, move laterally to locate valuable data, exfiltrate copies, and then encrypt systems while threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Listings on such sites are public claims made by the group; they are not independent confirmation that every assertion is accurate. Black X has previously appeared in open-source reporting for targeting organisations across multiple sectors and regions, using common initial-access methods such as phishing or exploitation of unpatched services. No additional statements by Black X specifically about the African National Congress, beyond the leak-site listing itself, are recorded in the facts available for this incident.

Who is African National Congress?

The African National Congress is South Africa’s oldest liberation movement and its dominant political party. Formed in 1912 to unite African people against colonial and later apartheid rule, it organised mass resistance, international campaigns and, for a period, armed struggle. After the 1994 democratic elections it received a mandate to help draft the new Constitution, adopted in 1996, and has remained the governing party for most of the post-apartheid era. As a mass membership organisation and national political structure it routinely holds membership rolls, internal communications, financial records, policy documents and correspondence with supporters, donors and government bodies. A breach of such material is consequential because it can expose both ordinary citizens who joined or interacted with the party and the operational workings of a central institution in South African public life.

What data was at risk

The only data type named in the available record is “internal files exfiltrated in a ransomware attack.” Exact contents have not been disclosed or independently verified. Organisations of this kind typically store membership databases, contact details, internal emails, financial ledgers, strategic planning documents and correspondence. Whether any of those categories were among the files claimed by Black X remains unconfirmed. Readers should therefore treat any assertion about specific personal fields—identity numbers, bank details or medical information—as speculative until further evidence appears.

Why it matters

For individuals, the main risks are identity fraud, phishing campaigns that exploit knowledge of party affiliation, and potential political or personal targeting if contact details or private correspondence become public. For the organisation, the exposure of internal files can undermine operational security, damage trust among members and partners, and create ongoing legal and reputational costs. Because the scale of the incident is unknown, the full extent of these risks cannot yet be measured; the prudent assumption is that any data held in the affected systems may now be in unauthorised hands.

Were you affected?

If you are a member, staff member, volunteer or regular correspondent of the African National Congress, treat the possibility of exposure as real until proven otherwise. Practical first steps include:

• Monitor bank and credit accounts for unfamiliar activity and enable transaction alerts.
• Change passwords on any accounts that reuse credentials linked to party email or membership portals, and enable multi-factor authentication where available.
• Be alert to phishing messages that reference ANC membership, donations or internal events; verify unexpected requests through official channels.
• Consider placing a fraud alert with South African credit bureaux if you hold sensitive personal identifiers that may have been stored by the organisation.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can surface other exposures that require attention.

AICompiled with AI assistance from public sources and published under our editorial standards.