Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Discovered 2026-09-30 03:40 UTC
Est. attack date 2026-09-29
Country KR
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

samwumed.org zoominfo.com/c/samwumed/346685548 SAMWUMED (founded 1952, Cape Town) is a closed, self-administered medical aid scheme serving South African municipal workers — roughly 35,000 members and 73,000 covered lives. It collects about R1.9 billion/year in contributions, kept reserves over R1.3 billion and posted a R14.3 million surplus in 2024 (solvency 68% vs the 25% legal minimum). Plans are income-banded and cheap (from ~R750/month with a 60% employer subsidy), covering hospitals, doctors, medication, dentistry and optics. Led by Principal Officer Francina Mosoeu with a union-appointed board, it administers benefits with Medscheme across a network of private hospital groups. Key problems right now: membership shrinking ~15%/year as young people leave, and an ongoing court battle with the Melomed hospital group over contract exclusions — plus the long-term threat of national health insurance reform.

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 94

Third Party Employee Credentials: 2


External Attack Surface: 8


Exposure Report
by ParanoidLab
428
Passwords
6 critical
7
Cookies
0 critical
Last queried 2026-09-30 03:40 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusedomains.co.za
MX Records
  • za-smtp-inbound-1.mimecast.co.za.
  • za-smtp-inbound-2.mimecast.co.za.
TXT Records
  • google-site-verification=Bmi07xLEaxjiHwB8BVUCXBXf9iKo3doZnsV5XsHPO-E
  • docusign=ed1cb5a7-eb68-48c2-a708-e0e02569d368
  • v=spf1 include:za._netblocks.mimecast.com include:sendgrid.net ~all
  • 8sucMbpF1FWO4F6WfAeUyhsC9J764qWkSlgVOYg/IHUfIDpqmmEiHO3+qq8GGKq+cB9eKslFSeFiw3lXgSmppw==
Cloud / SaaS Services Detected
DocuSign Mimecast SendGrid