Courier Guy files dumped on the dark web. Is your parcel data safe?

The Courier Guy says no customer, parcel or delivery data was in the files a ransomware group has dumped on the dark web. The group, MedusaLocker, posted what it says are the courier company's internal documents on its leak site on 4 November 2026 (MyBroadband; ransomware.live).

The company traced the files to an incident in August. "The investigation identified a single legacy file server as the likely source of the data the group claims to hold, and the server was immediately isolated," it told MyBroadband.

What is in the leaked files?

MedusaLocker describes the dump as operational paperwork. The company says the records are historical internal admin and finance documents, mainly about suppliers and landlords (MyBroadband).

Sources: MyBroadband, ransomware.live. The group's description is its own claim and has not been independently verified.

The group first listed the data for sale at about R493,400 ($30,000) and has since cut the price to about R239,300 ($14,548), MyBroadband reported (MyBroadband).

Did The Courier Guy report the breach?

Yes, the company says it did. It told MyBroadband it reported the August incident to the Information Regulator and the South African Police Service, notified its suppliers, and will notify other affected parties if its review of the leaked material shows it needs to. It says it has not been contacted by the group and has received no ransom demand (MyBroadband).

Under POPIA, companies must tell the Information Regulator and affected people when personal information has been accessed by someone unauthorised. If you're a supplier, landlord or staff member and want to know whether your details were in the files, ask The Courier Guy directly through its contact centre on 010 222 2300 (MyBroadband).

I got an SMS from "The Courier Guy" asking me to pay. Is it real?

No. The Courier Guy says it never asks recipients to pay a fee before delivery, doesn't offer cash-before-delivery or duties-unpaid shipments, and never asks for banking, card or personal details through a link. "Recipients never pay extra to receive a parcel," it said (MyBroadband).

The company also said scam SMSes using its name go out in bulk to random numbers and are not linked to its own customer records (MyBroadband).

How do I check a parcel safely?

Track it yourself instead of tapping a link. The Courier Guy's official channels, as it gave them to MyBroadband:

If the tracking status shows nothing, says the parcel doesn't exist or doesn't match what a message told you, the company's advice is to stop (MyBroadband). If you already entered card details on a fake page, contact your bank straight away using the number on the back of your card.