African National Congress Listed by Black X Ransomware Group

On August 28, 2025, the African National Congress appeared on the leak site of the Black X ransomware group, with the attackers claiming to have exfiltrated internal files from the historic political organization.

What's Publicly Reported from Reporting

Public reporting indicates the ANC was listed on the Black X leak portal hosted on an onion domain. The entry references a specific target identifier and states that internal documents were taken during a ransomware incident. No exact number of files or total size has been publicly detailed, and the precise systems breached inside the ANC have not been disclosed in available reporting. The ANC itself has not yet issued a public confirmation or denial as of the latest updates from ransomware tracking sites.

Internal files were the category of data listed as exfiltrated. Victim count remains unknown to the public. The listing date of August 28, 2025 marks when the group chose to publish the ANC on its leak site.

Why This Matters for You and Your Family

Even when a breach hits a large political organization, the consequences often reach ordinary people. Internal files can contain donor lists, membership records, employee details, email correspondence, or spreadsheets that include home addresses, phone numbers, dates of birth, and family member names. If any of that information matches data you or your family provided while engaging with political parties, community groups, or government-related services, your personal details may now be in the hands of criminals.

Once such data leaves a secure environment, it rarely stays contained. It can be sold quietly on underground forums or used to launch targeted attacks against individuals who appear in the files. For many families this means a sudden increase in phishing emails, vishing calls, or identity theft attempts that feel personal because the attackers already know details about your life.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at the first dataset. They look for connections that allow them to follow an identity chain from an organizational email to a personal account, from a work phone number to a family member’s social media, or from a leaked address to children’s online profiles. A single exposed record can link your professional or political activity to your home life, gaming usernames, or school records.

Credential leaks like this one cascade into account takeovers and doxxing chains. When passwords or email addresses from the ANC files match those used for personal services, attackers can seize control of accounts, demand ransom from individuals, or publish private information to embarrass or extort. Gaming accounts belonging to you or your children are especially vulnerable because they often reuse credentials and lack strong protections, turning a political breach into a direct threat to family safety and privacy.

Black X Ransomware Group Track Record

Public reporting attributes Black X with emerging in late 2024 as a ransomware operation that combines data theft with extortion. The group has listed a range of victims including corporations and, more recently, political or advocacy organizations. Their typical playbook involves gaining initial access, exfiltrating sensitive files before encryption, and then pressuring the victim by publishing samples or full datasets on their leak site when demands are not met. Extortion tactics focus on reputational damage and the threat of further data dumps rather than solely on file encryption.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the ANC breach.
• Rotate any password you used at the ANC or related political services anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that could be chained to the same leaked information.
• Let remediation specialists handle takedown requests for any personal records that surface on data broker sites or underground forums.

The most important forward-looking step is recognizing that political and community involvement should not expose your family to identity theft or harassment. Starting with a DoxxScan gives you both immediate visibility into existing risks and ongoing protection through its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Acting quickly limits how far attackers can travel down the identity chain that began with this claimed breach.