Erwat Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 29 February 2024, the South African water and wastewater management company Erwat was listed by the dragonforce ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details of the incident have not been disclosed.

The listing places a critical environmental-services organisation on a ransomware leak site. Because Erwat handles wastewater treatment and resource recovery for public and private clients, any compromise of its systems raises questions about operational continuity and the protection of internal records, even while the precise scope stays unconfirmed.

Breaking down the breach

According to the available record, Erwat was listed by dragonforce on 29 February 2024. The report characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No figure has been given for the volume of data taken, the number of individuals whose information may be involved, or the exact date the intrusion began. Technical methods used by the attackers, the duration of access, and whether systems were encrypted or only data was allegedly stolen have not been made public. The listing itself is the primary public indicator; independent confirmation of the full extent of the compromise has not been released in the material reviewed.

In short, the known facts are limited to the organisation named, the reporting date, the attribution to dragonforce, and the description of internal files removed during a ransomware incident. Everything else—scale, timeline, and recovery status—remains undisclosed.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has appeared on public leak sites in recent years. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems where possible and simultaneously copying data, then threatening to publish the stolen material if a ransom is not paid. Victims are commonly listed on dedicated leak portals with sample files or claims of exfiltration to increase pressure. The group has been observed targeting organisations across multiple sectors and geographies, often through initial access gained via phishing, compromised credentials, or unpatched remote services. Public reporting does not establish that dragonforce made additional specific claims about Erwat beyond the listing itself; the appearance of the company name on the group’s site is therefore treated as an unverified claim pending further corroboration.

Erwat and its sector

Erwat is described as a truly indigenous South African company with extensive expertise in all aspects of water and wastewater management. Its stated purpose is to improve the environment and human well-being by providing sustainable water care and resource recovery. It serves both public and private sectors, promoting a healthy environment through cost-effective wastewater treatment solutions and innovative technologies developed to meet rising demand for higher treatment quality.

Water and wastewater utilities sit within critical infrastructure. They manage treatment plants, distribution networks, laboratory data, regulatory compliance records, and operational technology that keeps sewage and industrial effluent from contaminating water sources. A breach at such an organisation can affect not only corporate files but also the continuity of services that communities rely on for public health. Even when the precise data taken is unknown, the sector’s importance means any confirmed intrusion warrants careful attention.

The information in question

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of those files—whether they include employee records, client contracts, engineering drawings, laboratory results, financial documents, or operational logs—has been released. The number of people whose personal information might be among the material is listed as unknown.

Organisations of this kind typically hold personnel files, supplier and client contact details, technical specifications for treatment processes, environmental monitoring data, and regulatory correspondence. They may also store authentication credentials for industrial control systems. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were taken. Readers should treat any assertion of specific data types beyond the published description as unverified.

What's at stake

For individuals whose information may have been present in the internal files, the practical risks include potential identity fraud, phishing campaigns that reference genuine organisational details, and long-term exposure of personal or professional data. Without a confirmed list of affected people or data fields, the degree of personal impact cannot be quantified, yet the possibility remains real.

For Erwat itself, the stakes include operational disruption if systems were encrypted, reputational harm from the public listing, possible regulatory scrutiny under South African data-protection rules, and the cost of forensic investigation and remediation. In the water sector, any compromise that could later affect plant controls or environmental reporting carries additional public-interest weight, even if no such effect has been reported here. The absence of disclosed numbers does not eliminate these concerns; it simply leaves their scale unknown.

If your data was in this claimed breach

If you have a past or present connection to Erwat—as an employee, contractor, client, or supplier—treat the possibility of exposure seriously until more information appears. Change passwords on any accounts that reused credentials linked to the organisation, enable multi-factor authentication wherever available, and monitor bank and credit activity for unusual transactions. Be alert to targeted phishing that references wastewater projects or internal company matters. South African residents may also wish to place fraud alerts with credit bureaux.

Because the full contents of the exfiltrated files have not been published, a practical next step is to check whether your email address has already appeared in other known breach datasets. Free exposure-scan services allow you to enter an email address and receive a report of previously recorded leaks; doing so provides an independent baseline while official notifications, if any, are awaited. Keep records of any correspondence you receive from Erwat or its advisers, and follow only verified guidance from the company or competent authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.