South Africa: Claims of an MTN Hack Have Been Greatly Exaggerated, but the Hacktivists Won't Stop

By Lindsey Schutters

When user ki4tane posted "MTN BREACHED" on a hacker forum, Daily Maverick's colleagues in the dark web business - Dark Notify - were quick to dismiss it as fake. But the retaliation against xenophobic attacks is a strong motivator for cyber retribution.

Here we go, again. On Sunday, 26 July 2026, a threat actor named ki4tane posted a thread on the Breached hacker forum titled "MTN BREACHED", featuring the official MTN yellow logo.

The post claimed that the group had exfiltrated a massive database cache of credentials:

"About hundred of your cred [client/customer credentials] will be all over the place sooner than we expected. Employee creds are also there about 2,000 of it... it was a big data but all it's gone, so sad" (sic)

The post explicitly framed this attack as a political retaliation, saying that "You eat alot of customers money, all because of the south Africa issues with Nigerians... well you cred [credibility] is now gone in just a blink of an eye". Cool.

Catch up: Hacktivists target SA government entities in cybercrime wave in response to xenophobia May 18, 2026 This incident is the latest activation of #OpSouthAfrica, a hacktivist campaign launched by groups including Nullsec Nigeria (also operating as Anonymous Nigeria), 404 Crew and Infernalis, which ignited in direct response to the wave of anti-immigration protests and xenophobic violence targeting Nigerian nationals and other foreign workers in South African metropolitan areas in early May...

Read the full story on Daily Maverick.

Copyright © 2026 Daily Maverick. All rights reserved. Distributed by AllAfrica Global Media (allAfrica.com). To contact the copyright holder directly for corrections — or for permission to republish or make other authorized use of this material, click here.