Kazu
A data theft extortion actor that has claimed attacks on health, government and education bodies. It is unclear whether Kazu is one person or a group, and little is known about how it gets in.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Few credible public sources cover this name. This page states only what they support, so gaps here do not mean the group lacks those capabilities.
Experts quoted by ISMG in November 2025 described Kazu as a newcomer focused on data theft extortion and not encryption. Bitdefender is cited as saying most victims are in Southeast Asia, the Middle East and South America.1
RNZ reports that it is unclear whether Kazu is one person or a group. A now-deleted post said the author was in Cuba, which is unverified.2 In January 2026, the online-harm group IOC3 said it had identified the person it believes is behind a New Zealand health hack, but New Zealand's NCSC did not confirm this and described attribution as complex.3
RNZ cites a ransomware tracking website as listing companies in the UK among Kazu's claims. That is unverified and does not establish a UK pattern.2
The analyst view that it exploits web platforms is only a suspicion, but patient portals and hosted applications would be a sensible place to check.
Key Events
Cyber Alert Nepal reports a hacker using the name allegedly stole data from a Nepalese ministry.2
ISMG reports a claim against a US healthcare technology firm. The company had not verified the figures.1
Claims a New Zealand patient portal breach and demands US$60,000, later removing its posts.2
IOC3 says it has identified a suspect. Authorities do not confirm this.3
Defences That Matter
Patch What Faces the Internet
- Keep an accurate list of internet-facing systems and patch them first.
- Prioritise VPN appliances, file transfer tools and web applications.
Limit What Can Leave
- Know where your most sensitive data sits and restrict access to it.
- Alert on bulk transfers to cloud storage and unfamiliar destinations.
Plan for Extortion
- Decide in advance who handles legal, regulatory and client communication if data is published.
- Rehearse a data theft scenario where backups do not solve the problem.
How Exposed Are Your Web Applications?
We can test your internet-facing systems and help you plan for a data extortion demand.