Namibian Defence Force Cyberattack: What the NDF Breach Means for Namibia
Analysis by Tech49Originals IT Solutions, Windhoek, Namibia. Published 18 September 2026.
The Namibian Defence Force has been compromised in a ransomware attack claimed by the criminal group RansomHouse. https://x.com/H4ckmanac/status/2100483480521990559
This is the fourth major Namibian institution to be hit in under two years, following Telecom Namibia, Paratus and the Namibia Airports Company. It is the first to involve the country's armed forces.
For Namibian businesses, government bodies and parastatals, the question this raises is not whether the country has a cybersecurity problem. That has been settled for some time. The question is why we keep finding out about breaches from criminals rather than from our own monitoring, and what it will take to change that.
What happened
The Namibian Defence Force was listed on the RansomHouse dark web leak site on 12 September 2026. Threat intelligence platforms that monitor ransomware operations picked up the listing on 16 September.
RansomHouse is an extortion operation that has been active since roughly late 2021. Unlike the classic ransomware model, the group has historically focused on stealing data and threatening to publish it, rather than always encrypting a victim's systems and demanding payment for a decryption key.
That distinction matters enormously, and it is the part most coverage will miss.
An encryption attack is loud. Systems stop working, staff cannot log in, and somebody notices within the hour. A data theft operation is silent. Nothing breaks. Nobody is locked out. An attacker can hold access for weeks or months, quietly copying information out of the network, and the first indication the victim receives is their own name appearing on a leak site.
"The silence is the whole problem," says Andrew Gatsi, Founder and Principal Cybersecurity Engineer at Tech49Originals IT Solutions. "If your detection strategy depends on noticing that systems stopped working, you will never catch a data theft, because nothing stops working. Someone logs in with valid credentials, moves through the network slowly, stages a few hundred gigabytes, and pushes it out over a fortnight through traffic that looks completely ordinary. You find out when the attackers decide it is time for you to find out."
Why a defence force breach is different
Most data breaches expose personal information. The damage is measured in identity theft, fraud and regulatory penalties, and it is serious.
A military breach exposes something else: organisational structure, personnel records, procurement documentation, deployment and logistics information, internal communications, and the identities of people whose safety may depend on not being identified.
The strategic risk is not only what is taken. It is what an adversary can build from it. Personnel data supports targeted social engineering against individual officers. Procurement records reveal capability and capability gaps. Internal correspondence reveals process, hierarchy and relationships. Each fragment is useful on its own, and considerably more useful in combination.
"Military data has a long half-life," Gatsi says. "A leaked credit card is cancelled in a day. A leaked personnel file, a deployment schedule or an org chart stays useful to a hostile party for years. That is why defence breaches cannot be assessed the way a commercial breach is assessed, and why the response window is measured differently."
There is also a national dimension that goes beyond this single incident. Namibia holds a reputation as one of Africa's most stable democracies, with a professional military under firm civilian control. Institutional credibility of that kind is an asset. Incidents like this one test it, and the response determines whether it holds.
The pattern nobody in Namibia should still be ignoring
Place this incident in sequence and the picture is unambiguous.
December 2024, Telecom Namibia. The ransomware group Hunters International exfiltrated more than 626 gigabytes of data, roughly 492,633 files. Telecom Namibia declined to pay. The attackers published, exposing personal and financial details belonging to ordinary subscribers, eight government ministries, five regional councils, ten municipal governments and senior officials including cabinet ministers. It remains the largest known data security incident in Namibian history.
2025, Paratus Namibia. A second major telecommunications operator compromised.
March 2026, Namibia Airports Company. NAC detected unauthorised access to parts of its network infrastructure and administrative accounts on 6 March, flagged after unusual system behaviour and intermittent network disruptions. NAM-CSIRT issued a public advisory on 16 March confirming the breach. The INC Ransom group subsequently published stolen data, which NAC described as including airport permit system files, parking management databases, engineering and project documentation, financial records and internal reports.
September 2026, Namibian Defence Force.
Telecommunications, then aviation, now defence. Four of Namibia's most sensitive institutional targets in under two years.
"This is not a run of bad luck and it is not a coincidence," Gatsi says. "Telecommunications, aviation, defence. Somebody is working through Namibian critical infrastructure in a recognisable order, and they are succeeding at a rate that should alarm every institution still on that list. The organisations that have not been named yet are not safer. They are earlier in the queue."
The national numbers
These are not projections or estimates from a vendor with something to sell. They are Namibia's own official figures, published by the Namibia Cyber Security Incident Response Team (NAM-CSIRT) under the Communications Regulatory Authority of Namibia (CRAN) for the second quarter of 2026.
| Metric | Q2 2026 | Change |
|---|---|---|
| Cyber vulnerabilities detected nationally | 513,921 | up 39.8% |
| Recorded cyber events | 161,547 | up 56.7% |
| Accessible Telnet services exposed | 42,941 | |
| DDoS participant events | 10,327 |
Two of those figures deserve separate attention.
42,941 exposed Telnet services. Telnet transmits credentials in plain text. It has been considered unsafe for internet-facing use for roughly three decades. Nearly 43,000 instances of it are currently reachable on Namibian networks, which means tens of thousands of systems in this country are one scan away from an attacker who does not need a sophisticated exploit, only a port and some patience.
10,327 DDoS participant events. This is not Namibia being attacked. This is Namibian machines that have already been compromised, conscripted into botnets, and used to attack targets elsewhere. In the vast majority of those cases, the owners have no idea.
"Read that second number again," Gatsi says. "Ten thousand incidents of Namibian infrastructure being used as a weapon against somebody else. Those organisations were breached, and they still do not know. That is the true national picture, and it is why I get impatient when people treat a named incident as an isolated event. The named incidents are the ones we happened to hear about."
Why Namibia keeps getting hit
Three structural factors compound each other, and none of them are secret.
The legislation is not yet in force
Namibia still has no dedicated Cybercrime Act. The Cybercrime Bill has been drafted for submission to Parliament, and the Data Protection Bill has been prepared for resubmission to cabinet. Until they are enacted, enforcement is assembled from the Electronic Transactions Act 4 of 2019, the Communications Act and the Penal Code. Namibia has signed the UN Convention on Cybercrime and ratified the African Union's Malabo Convention, but domestic machinery is still being built.
The practical consequence is that there is no comprehensive statutory breach-notification duty. No clearly defined data controller obligations. No established penalty framework. Which is precisely why Namibians so often learn about breaches from a criminal leak site rather than from the organisation that lost their data.
"Every Namibian organisation holding personal data right now is accumulating a compliance liability that has not been invoiced yet," Gatsi says. "When the Data Protection Bill is enacted, regulators will not confine their attention to what happened after the commencement date. They will look at the systems, the retention practices and the data you already hold today. Organisations that start mapping their data now will experience that legislation as paperwork. The ones that wait will experience it as a crisis."
Detection capability has not kept pace with connectivity
The ITU Global Cybersecurity Index 2024 places Namibia in Tier 4, classified as "evolving", with a score of 36.93 out of 100. Nationwide 4G population coverage sits around 88.4%, and rural connectivity continues to expand.
Both facts are true simultaneously, and together they describe the problem precisely. Namibia is connecting faster than it is defending. Every new connection is a new attack surface, and the defensive layer has not caught up.
The skills gap is the real bottleneck
Namibia does not have a shortage of security products. Any vendor will sell a Namibian organisation a next-generation firewall, an endpoint agent and a SIEM licence tomorrow morning.
What Namibia has a shortage of is people who can operate them.
A SIEM that nobody tunes produces noise. An EDR platform that nobody triages produces false confidence. Most Namibian security failures are not procurement failures. They are operational failures, and the reason is arithmetic: continuous 24-hour coverage requires a minimum of five to six trained analysts to staff a roster, in a market where experienced security engineers are scarce, expensive and heavily recruited abroad.
"I have walked into Namibian environments with genuinely excellent tooling and no defenders," Gatsi says. "Enterprise licences nobody uses, dashboards nobody opens, alerts firing into a shared inbox nobody owns. Security is not a product you purchase. It is a function you run. Most organisations here have not yet made that distinction, and the ones being named on leak sites are the ones who ran out of time to make it."
What every Namibian organisation should do this month
None of the following requires a large budget. All of it is worth doing before your name is the one in the headline.
1. Establish whether you would detect data exfiltration. Not an encryption event. A quiet theft. If you cannot describe the specific control that would catch several hundred gigabytes leaving your network over two weeks, you do not have one. This is the single most important question in this article.
2. Audit your external attack surface. Given that NAM-CSIRT found nearly 43,000 exposed Telnet services nationally, assume you have exposures you are unaware of. Enumerate everything of yours reachable from the internet, then close whatever does not need to be there. Legacy management protocols, forgotten test servers and abandoned subdomains are where these incidents begin.
3. Enforce multi-factor authentication everywhere that matters. Remote access, VPN, email, cloud consoles and every administrative account. Stolen credentials remain the most common initial access vector, and MFA remains the highest-return control available at the lowest cost.
4. Verify your backups by actually restoring from them. A backup you have never tested is a hypothesis, not a control. Confirm that at least one copy is offline or immutable and genuinely beyond an attacker's reach, because modern operations delete backups before they encrypt anything.
5. Centralise and retain your logs off the systems that generate them. If you are breached and your logs sit locally on compromised machines, your forensic investigation is over before it starts. You will not be able to establish what was taken, when, or by whom.
6. Write your first-hour playbook before you need it. Who gets called. Who has authority to disconnect a production system. Who talks to staff. Who notifies NAM-CSIRT. Who talks to the press. Decide all of it while nothing is on fire, because you will not decide it well at 03:00 during an active incident.
7. Train your people on phishing, and measure whether it works. Most breaches in this market begin with one convincing email. Run controlled simulations, track click rates over time, and treat the number as a metric rather than a training exercise.
"If a Namibian organisation does exactly one thing after reading this, make it number four," Gatsi says. "Restore from a backup this week and time how long it takes. Most organisations discover during a live incident that their recovery plan was an assumption rather than a procedure. Making that discovery on a quiet Tuesday afternoon is survivable. Making it mid-breach is not."
Namibia needs to defend Namibia
There is a larger argument underneath this incident, and it is one Tech49Originals has been making for some time.
When Namibian security monitoring runs entirely on foreign platforms, processed on foreign infrastructure, supported from foreign time zones, the country's most sensitive operational telemetry leaves the country. Every authentication, every internal hostname, every network path, every failed login. For a defence force, a ministry, a regulator or a state-owned enterprise, that is not a procurement detail. It is a sovereignty question.
There is a cost dimension too. Global SIEM platforms are priced per gigabyte ingested, in United States dollars, on licensing models built for organisations with nine-figure IT budgets. The predictable outcome across Namibia is deliberate under-logging: organisations collect less data than they should, because they cannot afford to ingest what they actually need to see. Under-logging is not a budget decision. It is a blind spot that gets created on purpose.
This is why Tech49Originals built Vanguard, a Namibian-developed Security Operations Centre platform that brings SIEM log correlation, XDR detection and response, and network intrusion analysis into a single system designed around Namibian bandwidth, Namibian budgets and Namibian regulatory obligations, with local data residency in mind and support based in Windhoek.
Vanguard is available fully managed, with Tech49Originals analysts monitoring and responding on your behalf, co-managed alongside your internal IT team with after-hours coverage from us, or as a platform your own security staff operate with our onboarding and tuning support.
Tech49Originals IT Solutions issued the following statement:
"The Namibian Defence Force incident should end any remaining debate about whether this country has a cybersecurity problem. We would ask commentators to resist the temptation to speculate about attack vectors or operational impact before the investigation concludes, because that speculation helps adversaries and hinders responders. What we will say is that the national risk picture is publicly documented, officially reported by NAM-CSIRT, and rising quarter on quarter. Tech49Originals is available to support any Namibian institution requiring incident response, digital forensics or security monitoring capability. We make that offer in the national interest. Namibia's digital sovereignty has to be defended by Namibians, and building that capacity at home is the entire reason this company exists."
About Tech49Originals
Tech49Originals IT Solutions is a Windhoek-based Namibian technology company providing cybersecurity, web development, custom software, network solutions and IT support to businesses, institutions and government bodies across Namibia.
Our cybersecurity practice covers network, web application, mobile and physical penetration testing, vulnerability assessments, SOC and SIEM monitoring, XDR and intrusion analysis, digital forensics and incident response, phishing simulation and security awareness training, and compliance gap reviews against ISO/IEC 27001, the NIST Cybersecurity Framework and Namibia's National Cybersecurity Incident Management Guidelines 2026.
The company was founded by Andrew Gatsi, a Namibian cybersecurity engineer holding an Bachelor's Degree in Cybersecurity and Digital Forensics and the ISC² CGRC certification in governance, risk and compliance. Gatsi served as African Cybersecurity Team Captain for AFRICC, the African Region to the International Cybersecurity Challenge, the continental programme established by the Namibia University of Science and Technology to field Africa's team against Europe, Asia, the Americas and Oceania at the international championship. The Tech49Originals team includes ethical hackers and penetration testers who have represented Namibia in international competition.
"Namibia produces world-class security talent. I have captained them against the best teams on the planet," Gatsi says. "What this country has not yet built is the institutional capacity to keep that talent home and pointed at our own infrastructure. Every incident like this one is an argument for building it faster, and for building it here."
Frequently asked questions
What happened to the Namibian Defence Force?
The NDF was listed by the RansomHouse extortion group on its dark web leak site on 12 September 2026, in an incident affecting Namibia's national military organisation.
Who is RansomHouse?
An extortion group active since approximately late 2021. RansomHouse has historically concentrated on stealing data and threatening publication rather than encrypting victims' systems, which makes its operations considerably harder to detect.
Is this the biggest cyberattack in Namibian history?
By sensitivity of target, it is the most serious to date, being the first involving the armed forces. By volume of exposed data, the December 2024 Telecom Namibia breach remains the largest known incident, affecting records associated with roughly 492,633 files.
Why does Namibia keep getting attacked?
Three compounding reasons: cybercrime and data protection legislation is not yet enacted, national detection capability lags well behind rapid growth in connectivity, and there is an acute shortage of trained security analysts to operate the tools organisations have already bought.
What should my organisation do right now?
Establish whether you could detect data exfiltration, audit your internet-facing attack surface, enforce multi-factor authentication, test a backup restore, centralise your logs off the systems that produce them, write a first-hour incident playbook, and run measured phishing simulations.
What should we do if we think we have been breached?
Do not power off affected systems, do not delete anything, and do not discuss the incident over channels that may themselves be compromised. Preserve evidence, engage incident response support immediately, and notify NAM-CSIRT. What you do in the first hour determines what can be recovered, what can be attributed, and what you can defensibly report.
Who do we report a cyber incident to in Namibia?
NAM-CSIRT, operating under the Communications Regulatory Authority of Namibia, is the national coordination point. Private incident response, digital forensics and monitoring are available from Tech49Originals in Windhoek.
Does Namibia have a data protection law?
Not yet in force. The Data Protection Bill and Cybercrime Bill are both progressing. Organisations currently operate under the Electronic Transactions Act 4 of 2019 and related legislation. Preparing before enactment is considerably cheaper than remediating afterwards.
What is the difference between SOC, SIEM and XDR?
A SIEM collects and correlates log data from across your environment. A SOC is the team and process that monitors that data and acts on it. XDR extends detection and active response across endpoints, network, identity and cloud. Vanguard by Tech49Originals delivers all three.
How much does cybersecurity cost for a Namibian business?
Considerably less than an incident. Penetration testing is priced by scope, and monitoring is priced by log sources and endpoints. Tech49Originals provides written, itemised quotations after a scoping conversation.
If you would not know, find out
The uncomfortable question this incident raises is not about the Namibian Defence Force. It is about every other Namibian institution that has never tested whether it would notice.
Most organisations in this country discover a breach weeks after it began, and usually because somebody else tells them. That interval is where the entire damage is done.
Tech49Originals IT Solutions
Cybersecurity services: tech49originals.com/cybersecurity
Vanguard SOC platform: vanguard.tech49originals.com
Email: [email protected]
Phone and WhatsApp: +264 81 806 8136
Windhoek, Namibia. Serving organisations nationwide and across the SADC region.