On October 23, 2026, the account Dark Web Intelligence reported that a threat actor on an underground forum claims to have stolen 366 GB from Rand Mutual Assurance (RMA), the South African insurer that handles workplace injury and occupational disease compensation. The same post says RMA "has not confirmed an incident" and calls it an "unverified threat-actor claim, NOT confirmation of a breach." We agree with that framing, and this post keeps the claim and the evidence apart.
TL;DR
| Question | Answer |
|---|---|
| Was RMA breached? | Unconfirmed |
| Who claims it? | An actor on an underground forum, relayed by Dark Web Intelligence |
| Claimed size | 366 GB, 593,786 files, 1,683,810 claim records |
| Demand | $95,000, release deadline Nov 5, 2026 |
| RMA response | None found at time of writing |
| Independent evidence | None found: no sample, no vendor or researcher analysis |
| Access method | Unknown |
Claimed vs verified
| Claim | Status | Source |
|---|---|---|
| RMA named by a forum actor | Reported, second-hand | Dark Web Intelligence, Oct 23 |
| 366 GB, 593,786 files | Claimed by the actor | Same |
| 1,683,810 claim records | Claimed by the actor | Same |
| $95,000 demand, Nov 5 deadline | Claimed by the actor | Same |
| Data includes IDs, medical details, banking details | Typical of such claims; not shown for this dataset | Analyst note in the same post |
| RMA confirmed an incident | No statement found |
A web search for the company name and the figures turned up no other reporting at the time of writing.
Why claim data is a fraud risk even before confirmation
Compensation claims tie a person to an employer, a medical situation and, often, a bank account for payouts. If a dataset like that is real, the main risk is not account takeover but believable fraud: a caller who knows your injury, employer and claim stage and asks you to "re-verify" banking details to release a payment. Those scams can start before an insurer has finished investigating, so claimants benefit from knowing the pattern now.
What to do
Claimants and employers
- Treat unsolicited contact about a payout, medical review or banking change as suspect, even if the caller knows details of your claim.
- Do not give ID or banking details on an inbound call, SMS or email. Call RMA back on a number you already hold.
- Check your bank statements and enable transaction alerts.
- Employers that submit claims on behalf of staff: warn those staff to expect scam attempts, and check what claim attachments your own systems hold.
Insurers and similar organisations
- Warn claimants early that you never ask them to re-verify banking details by phone.
- Check whether the claimed volumes match what you hold: record counts, file counts and date ranges are the fastest way to rule a claim in or out.
What to watch for
- A statement from RMA or a regulator.
- A sample of the data and any independent analysis of it.
- Whether anything is released around the November 5 deadline.
We will update this post if RMA or a named research team confirms or refutes the claim.
Related reading
- October 2026 attacks timeline
- PwC Everest breach claim: claimed vs verified
- OpenRouter breach claim: what is verified and what is not
Sources: Dark Web Intelligence (@DailyDarkWeb) post, Oct 23, 2026
Details are accurate as of October 23, 2026. This is a developing claim and may change.