SA Threat Brief: Week 30

What Business Owners Need to Know This Week

Week 30 (12–19 July 2026) is the week the domestic measurement caught up with the domestic reality. Six weeks of zero new South African leak-site listings ended at every confidence tier at once: BE Travel confirmed a ransomware incident with a government supply-chain dimension, the Gauteng e-Government jobs portal breach was confirmed on the legislative record, and Rectron — one of South Africa’s four largest technology distributors — closed every office nationwide during an outage that sources attribute to a breach. Externally, Microsoft shipped the largest single-month patch release in its history at 621 CVEs, two of them already under active exploitation, while CISA added ten KEV entries in seven days and the Australian Signals Directorate confirmed the web-estate campaign this report flagged in W29 is operating globally across 17 named CVEs.

The Bottom Line: The common thread is supply chains. BE Travel books travel for the Housing Development Agency, Rectron supplies hardware and security products to a large share of the SA IT channel, and the Gauteng breach rode one ordinary user account against a control the Auditor-General recommended in 2023/24 that remains unfunded two financial years later. Severity has also stopped working as a filter: an actively exploited SharePoint flaw rated CVSS 5.3 sits alongside a CVSS 9.9 hypervisor escape with no KEV entry at all. Both common patching policies fail on one of the two.

The Week in Numbers

• 2 confirmed SA incidents, 1 probable, 2 leak-site claims — ending a six-week run of zero new listings; HIGH threat level for the 10th consecutive week.
• 621 Microsoft CVEs — the largest single-month release ever recorded, 63 of them Critical, on 14 July; 2026 year-to-date already exceeds every full-year total of the last two decades.
• 2 actively exploited Microsoft zero-days — AD FS CVE-2026-56155 and SharePoint CVE-2026-56164, both added to the KEV on 14 July.
• CVSS 5.3 — the score on CVE-2026-56164, unauthenticated, no user interaction, and being exploited now. Severity-threshold patching would have deprioritised it.
• CVSS 9.9 — CVE-2026-57092, a Windows VMSwitch guest-to-Hyper-V-host escape, with no KEV entry and therefore no deadline.
• 10 new CISA KEV additions — up 67% from six the prior week, with 17, 18 and 19 July deadlines that had all lapsed by publication.
• 283 records — exposed in the Gauteng jobs portal breach, including certified SA ID copies, proof of residence and full CVs.
• 17 CVEs — named in the 13 July ACSC alert on a global webshell campaign across WordPress plugins, Joomla, Craft CMS, MaxSite and MetInfo, with SMEs explicitly among the victims.
• R29.6 billion — the Department of Human Settlements budget behind the Housing Development Agency, whose 36-month travel tender BE Travel holds.
• 2,065 weekly attacks per organisation — Check Point’s June figure for South Africa, fourth in Africa, below the African average and above the global one.
• 7 weeks — since the Information Regulator last published anything.

Major Incidents: Who Was Hit and How

BE Travel — Confirmed Ransomware with a Government Supply-Chain Reach

BE Travel’s information officer confirmed that the company suffered a ransomware incident on 4 July 2026 on a dedicated server hosting its travel voucher and administration management system, that the environment was isolated immediately, that POPIA notifications have been issued to affected data subjects, and that contact attempts from Arcus Media were received but not engaged. Full names, residential addresses and contact details of shuttle-service customers plus travel voucher data may have been accessed or encrypted. Two features raise this above its company size. First, BE Travel holds the active 36-month travel-management tender for the Housing Development Agency, the state property developer inside a R29.6-billion departmental budget, so travel patterns and personal details of officials working on state housing projects may sit in the affected system. Second, the timeline: nine days elapsed between compromise and leak-site listing, and the actor’s seven-day publication countdown expired 20–21 July. Organisations that book travel through third-party agencies should establish in writing what personal data the agency holds on their employees and what its breach-notification obligation to them is.

Gauteng e-Government Jobs Portal — 283 Identity Document Sets

Gauteng MEC for e-Government Bonginkosi Dhlamini confirmed in a written reply to the Provincial Legislature, reported 14 July, that the provincial e-Recruitment portal was breached, exposing 283 application records — application forms, CVs, qualifications, certified copies of South African ID documents, contact details and proof of residence. The count is small; the field set is close to a worst case for identity fraud, and job applicants have no ongoing relationship with the department through which they would notice misuse. Two details deserve board attention. The department’s own account is that MFA was enabled and a compromised non-privileged account was still sufficient to reach 283 complete applicant files — an authorisation and data-access design problem, not an authentication one. And a Network Access Control system recommended by the Auditor-General in the 2023/24 audit remains unimplemented on funding grounds, converting a known finding into an accepted risk with no compensating control. No post-breach penetration test was performed.

Rectron — Nationwide Shutdown at a Top-Four Distributor

Rectron posted notice of a network outage on 16 July at 15:58 and by 17 July had closed all offices nationwide — Midrand, Cape Town, Durban, Bloemfontein and Port Elizabeth — with only the main Johannesburg line functional. Sources close to the matter attribute the outage to a breach and say external specialists were brought in; Rectron has neither confirmed nor denied a cyberattack. The outage is confirmed; the cause is rated PROBABLE. It matters well beyond one company: Rectron distributes hardware and enterprise security products across a large share of the SA reseller base, so channel partners face order, licensing and support disruption and — if the breach attribution holds — a supply-chain trust question over systems that integrate with the distributor’s ordering and licensing platforms. Treat unexpected “Rectron” order or invoice correspondence with suspicion until the company clarifies, and review any credentials or API integrations shared with them.

Leak-Site Claims — Isegen, and a Phantom SA Victim

DragonForce listed Isegen South Africa, a KwaZulu-Natal speciality chemicals producer, on 15 July, claiming data theft with a threat to publish absent negotiation. No sample has been verified and Isegen has made no statement, so this remains an uncorroborated actor claim — but it is the most significant SA leak-site development since early June. Separately, m3rx listed suppcentersa.com on 17 July with a ZA country tag. This report does not count it as a South African victim: the same record describes an Xcitium partner operating in Latin America with a Costa Rican (+506) number, making the tag a geolocation artefact. It is documented here precisely because the tag is machine-readable and will otherwise propagate into automated South African feeds as a phantom domestic incident. Treat single-source geographic attribution in leak-site data as an indicator requiring confirmation, not a fact.

POPIA and Regulatory

The Information Regulator has now published nothing for seven weeks, and the TransUnion SA and Experian SA credit-bureau matters remain without published outcome. Register that silence as a planning assumption rather than a reprieve: do not read absence of enforcement as tolerance, and plan on the conservative reading of section 22 notification. The BE Travel incident is a live POPIA case — notifications issued to data subjects, Regulator obligations engaged — and the Gauteng breach is now a dated public record of a known unremediated weakness, which is a materially different governance position from an unforeseen failure. The Profmed / PPSHA matter passes seven weeks unresolved with KeyHealth, SEDMED, De Beers Benefit Society and the SANDF RFMCF still neither confirmed nor excluded, and remains the highest-value unresolved South African exposure.

Full Intelligence Report

The complete Week 30 technical report covers the full incident write-ups with confidence ratings, the ten-entry KEV batch and lapsed deadlines, the 621-CVE Patch Tuesday analysis, the ACSC webshell campaign and its 17 CVEs, threat-actor profiles, the sector heatmap, ransomware landscape, OSINT exposure analysis, structured hunt missions with IOC tables and the full source list.

What Your Business Should Do Right Now

• Clear the lapsed KEV deadlines in exposure order: SonicWall SMA 1000 (CVE-2026-15409, CVE-2026-15410) first, because exploitation preceded the patch and the appliance is internet-facing by design — patching alone is insufficient, so assume pre-patch access, rotate credentials and session tokens, and review logs from 1 July. Then SharePoint CVE-2026-58644 and CVE-2026-56164, the FortiSandbox pair, then Oracle EBS CVE-2026-46817.
• Fix the patch-prioritisation policy, not just the patches: CVE-2026-56164 is CVSS 5.3 and actively exploited; CVE-2026-57092 is CVSS 9.9 with no KEV entry. A policy of “patch KEV within deadline, patch 9.0-plus within 30 days” misses both. Move to an exposure-first model — internet-reachable assets and identity infrastructure get the shortest clock regardless of score, with KEV membership setting deadlines and CVSS breaking ties.
• Build the CMS asset register this week: Enumerate owned domains and subdomains from DNS and certificate-transparency logs, resolve each to a hosting party and a named internal owner, and record CMS and plugin versions against the 17 CVEs in the ACSC alert (Ninja Forms, Gravity Forms, WPvivid Backup, Breeze Cache, GutenKit, Simple File List, Joomla JCE, Craft CMS, MaxSite, MetInfo). Then inspect web directories for unexpected files and review access logs for requests to unusual paths.
• Treat AD FS and on-premises SharePoint as tier-zero identity infrastructure: Four SharePoint KEV entries in three weeks and an exploited AD FS privilege-escalation flaw (CVE-2026-56155, 28 July deadline) justify a standing control set — restricted admin group membership, token-signing certificate change alerting, internet-exposure review and web-root file-integrity monitoring. Patch ahead of the deadline, not on it.
• Audit your open findings for the Gauteng pattern: Which audit or assessment findings are currently open on funding grounds, and for each, is the compensating control and residual-risk acceptance documented in writing and dated? An unfunded finding with no recorded compensating control is an accepted risk that nobody formally accepted.
• Map third-party data custody: Medical scheme administrators, retail delivery platforms, and now a corporate travel agency holding passport scans and lodged card details. Identify every third party holding personal data on your employees or customers and confirm in writing what they hold and what their breach-notification obligation to you is. Most organisations discover it is unspecified.
• Extend log retention to the assets in this report: Several hunts require logs back to 1 July, and SonicWall appliance logs and Oracle EBS audit trails are commonly not collected or kept under 30 days. Where a hunt cannot run for want of data, record that as a risk-register finding rather than closing it as negative.
• Put generative AI data exposure on the risk register: Check Point records 3.9% of corporate AI prompts carrying high risk of sensitive data exposure. Most SA POPIA programmes do not treat prompt content as a processing activity — that gap will close by incident or by regulation, and closing it deliberately is cheaper.