Claims of an MTN hack have been greatly exaggerated, but the hacktivists wonât stop

This story has significance for readers across Africa and beyond.

Here we go, again. On Sunday, 26 July 2026, a threat actor named ki4tane posted a thread on the Breached hacker forum titled âMTN BREACHEDâ, featuring the official MTN yellow logo.

The post claimed that the group had exfiltrated a massive database cache of credentials:

âAbout hundred of your cred [client/customer credentials] will be all over the place sooner than we expected. Employee creds are also there about 2,000 of it... it was a big data but all itâs gone, so sadâ (sic)

The post explicitly framed this attack as a political retaliation, saying that âYou eat alot of customers money, all because of the south Africa issues with Nigerians... well you cred [credibility] is now gone in just a blink of an eyeâ. Cool.

This incident is the latest activation of #OpSouthAfrica, a hacktivist campaign launched by groups including Nullsec Nigeria (also operating as Anonymous Nigeria), 404 Crew and Infernalis, which ignited in direct response to the wave of anti-immigration protests and xenophobic violence targeting Nigerian nationals and other foreign workers in South African metropolitan areas in early May 2026.

Same script, different cast

Nullsec Nigeria has previously targeted several South African state institutions, including Sita, the South African Civil Aviation Authority, the National Space Agency, Sassa and the Department of Correctional Services.

Their declared operational goal is to expose government and corporate failures to force the South African government to halt anti-foreigner actions. But unlike typical cybercrime syndicates, their primary motivation is political vigilantism and digital retaliation rather than ransomware or direct financial extortion.

Daily Maverick was tipped off about the post by our dark web research colleagues Dark Notify, who also provided sample text files of the allegedly stolen data.

A meticulous analysis of the leaked files exposes significant discrepancies between the threat actorâs sensationalist claims and the actual technical reality of the exposed data.

For instance, client.txt and client.emails.txt reveal that these are not customer billing accounts or mobile money (MoMo) wallets â as per the hacker claims. Instead, they are registration credentials for MTNâs developer portals. Specifically developers.mtn.com, momodeveloper.mtn.com, and hsdpportal.mtn.com.

On the employee credentials side, it is similarly dubious. While the files do contain multiple entry records of MTN employee logins (primarily ending in @mtn.com or formatted as domain accounts like MTNGroupsa\xxx), the credentials are more likely historical, duplicate or test-related data.

Big yellow taxonomy

When we at Daily Maverick presented the facts to MTN (yes, on a Sunday), the communications team didnât immediately panic and sent a measured, informed response (read: theyâve seen this movie before).

âMTN is aware of the claim. Our assessment indicates that the material published does not point to any new compromise of MTNâs systems. MTN takes the security of its systems and customer information seriously. We continuously monitor our environment, investigate reported threats and take appropriate action where required.â

If you paid attention, they said âdoes not point to any new compromiseâ. In 2025, MTN experienced a cybersecurity incident involving a legacy environment that was scheduled for migration into a new fully managed domain.

Before the migration was completed, the data was compromised, exposing a logging server receiving data from several operating companies.

The company moved quickly to permanently remove the compromised server within 48 hours, notifying regulators and initiating a group-wide review that informed a two-year cybersecurity enhancement programme set for completion in 2026.

Given that the credentials in the current dump are mostly historical, test-related, or developer-centric, it is likely that the published files are recycled or aggregated data harvested during the 2025 breach â rather than a breach of MTNâs active, fully managed production networks.

What does a data breach cost?

According to the latest IBM Cost of a Data Breach report, in South Africa, the average cost of a data breach stands at about R50-million ($2.78-million) per incident.

Asking around for insurance underwriter estimates breaks the cost centres down almost neatly into thirds:

Detection and escalation (33.4% of total costs): The largest expense, covering forensic investigations, IT audits, crisis management and executive board communications.

Lost business (30.0% of total costs): Financial losses stemming from operational system downtime, customer churn, reputational damage and diminished goodwill.

Post-breach response (28.0% of total costs): Tactical recovery costs, including establishing inbound help desks, credit monitoring/identity protection services for victims, legal expenditures and regulatory fines.

Notification (8.8% of total costs): Administrative and legal costs associated with notifying data subjects, ombudsman schemes and regulators.

But there is a turn coming in corporate South Africa away from reactive IT defence towards building cyber resilience.

Richard Ford, group CTO at Integrity360, sees a similar market trend: âBoards have spent years asking whether their organisations are secure enough, but the better question today is whether the business can still operate when security fails.â

âIn a threat environment shaped by ransomware-as-a-service, AI-assisted social engineering, and machine-speed vulnerability discovery, prevention has a ceiling⦠Sooner or later, something will get through which means recovery time of both a strategic number and a competitive one.â

His answer? Companies should separate the responsibility of maintaining business continuity to a chief resilience officer role and invest in recovery capability.

The age of building ever higher walls around data is not over, but the cybercriminals are well coordinated and resourced enough to crack any tiny opportunity wide open.

MTN CEO Ralph Mupita shared some data in the wake of the xenophobic attacks that says 82% of MTNâs earnings come from outside South Africa. South Africa contributes only 18%.

Xenophobia is harming South Africaâs economic champions more than it is helping the economy, and the retaliation attacks are hitting where it hurts most. DM

Reporting originally appeared via Daily Maverick. Read the full source for additional context.