The dark web is a hidden part of the internet that isn’t indexed by standard search engines.
Cyber crime group “The Gentlemen” has dumped data allegedly stolen from insurer Hollard on the dark web, escalating the fallout from a June cyber attack on its third-party technology provider, MIP Group.
ITWeb understands the group demanded a ransom payment from the insurer in exchange for not making the data public.
A cyber security researcher has confirmed that Hollard customer data is publicly available on the dark web.
The dark web is a hidden part of the internet, often used by cyber criminals to trade stolen data, credentials and other illicit goods.
MIP Group reportedly paid an undisclosed amount to the hackers, who have now turned their attention to its clients in an attempt to extort money.
The data leak follows the June cyber attack on MIP Group, which potentially exposed information linked to multiple financial services organisations.
MIP Holdings provides policy administration, customer relationship management and related technology to insurers, healthcare providers, lenders, pension administrators and business process outsourcing companies.
The company says it notified affected stakeholders of the cyber attack, in which personal information linked to customers of about 45 South African insurance companies was compromised.
In a statement to ITWeb, Hollard says it is unable to comment on any details regarding payment.
“However, Hollard is aware that information associated with a previously disclosed cyber security incident involving MIP, a third-party service provider to a number of organisations within the insurance sector, has reportedly been published online. The information appears to be linked to the June 2026 cyber security incident involving MIP and not to any breach compromise of Hollard’s systems,” says the company.
According to the insurer, at this stage, the matter appears to be isolated to individual funeral policyholders.
“We have already notified customers who were affected by the June 2026 incident and are engaging with the relevant regulatory authorities.
“Based on the forensic and assurance activities conducted to date, there remains no evidence of compromise within the Hollard environment.”
As a precaution, the company says customers are encouraged to remain vigilant against unsolicited communications, phishing attempts and requests for personal or financial information.
Emerging in mid-2025, The Gentlemen is a cyber crime group that breaks into company networks, steals sensitive data and encrypts victims’ files, according to cyber security firm FortiGuard Labs.
The firm says the group then demands a ransom to recover the encrypted files, with the added threat that it will publish the stolen data online if the company refuses to pay – a strategy commonly known as double extortion.
According to FortiGuard Labs, the group is speculated to operate out of Russian-speaking regions, based on a prohibition imposed by its operators against targeting organisations in Russia and other Commonwealth of Independent States countries.
The firm adds that, as of early 2026, the group’s data leak site listed more than 200 victim organisations in over 50 countries across every major continent.
These victims represent more than 20 industries, including energy, government and healthcare services.
The Gentlemen publicly advertises its tools on underground criminal forums, operating what appears to be a ransomware-as-a-service programme and promising affiliates a “generous” 90% cut of the profits.
