Mad Liberator leaked ZB Financial Holdings data after Zimbabwe group refused ransom

ZB Financial Holdings, one of Zimbabwe's largest diversified financial services groups, was listed as a victim by the Mad Liberator extortion group, which published data it said had been taken from the company after ZB declined to pay a ransom.

The leak site tracker Ransomware.live recorded the listing on July 17, 2024 and placed the intrusion itself around July 13. Techzim, which reviewed the published material and reported the case on August 3, 2024, said it included customer and employee records, business account applications and operational files dating from 2017 through July 2024, amounting to several gigabytes. Mad Liberator was a newly observed group at the time, with a small number of victims named on its portal across several countries.

ZB had told customers on July 16 that its systems were unstable, then said on July 23 that services had returned to normal, without connecting either notice to a security incident. When the leak became public, the group acknowledged "social media reports purporting a breach on our systems" but denied compromise, stating that all its platforms were secure and that banking, insurance and investment services were uninterrupted.

Techzim reported that the company did not answer repeated questions over more than a week and that customers whose records appeared in the leak were not directly notified. A local cyber security specialist quoted in that report attributed the compromise to an absent patch management programme combined with weak endpoint, web and email security.