Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Esri South Africa

esri-southafrica.com
Group Thegentlemen
Discovered 2026-11-12 09:57 UTC
Est. attack date 2026-11-11
Country ZA
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

esri-southafrica.com sri South Africa is the exclusive distributor of Esri's ArcGIS geospatial platform in southern Africa, founded in 1989 in Midrand with 206 employees across 5 offices and over 2,000 clients. Led by Managing Director Patrick McKivergan, it serves government, utilities, mining and banking sectors with major projects like the City of Cape Town CityMap Viewer and ESKOM asset management. Its Esri South Africa College offers an NQF Level 6 Diploma in GISc&T and is the only Esri accredited learning center in the region. The company holds B-BBEE Level 1 status and runs free GIS training for unemployed youth. It participates in the Map Africa Initiative with Microsoft and Space42 to map all 54 African countries. Revenue is estimated at 23.2 million dollars with government contracts including a R34 million deal with DFFE.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 33

Third Party Employee Credentials: 5

External Attack Surface: 13

Exposure Report
by ParanoidLab
784
Passwords
44 critical
24
Cookies
0 critical
Last queried 2026-11-12 09:57 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • esrisouthafrica-com01b.mail.protection.outlook.com. Microsoft 365
TXT Records
  • v=spf1 ip4:102.33.60.116 ip4:105.30.24.229 include:mail.housekeeper.net.za include:_sg95rgwh5.sdmarc.net include:sendgrid.net -all
  • everlytic-site-verification=cb4b4b70dac492d778ca6e8e729ea142393f7ccebfb791bb808fc7e0ba11c00341ef78d8220442585edfa84bee0e93a23b97e0163652f294718ca3546cb6b754
  • ms-domain-verification=b3b61bd0-0921-4ef7-bc2a-30011c2e6c30
  • google-site-verification=ByyuY0KFytGW1e1CXuxvjOmnbdTPI0tnVjXPnRbWJaA
Cloud / SaaS Services Detected
SendGrid

Other recent victims

Same group: Thegentlemen
Same sector: Technology
Same country: South Africa

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.