At least ten South African government departments or their related entities suffered substantial cyberattacks in the past five years, sometimes due to a lack of properly secured systems and insider involvement.<\/p>\n\n\n\n
In the most recent incident, a ransomware attack took down the South African Weather Service’s (SAWS’s) IT systems, including its website, emails, and aviation and marine services.<\/p>\n\n\n\n
SAWS plays a vital role in monitoring weather patterns and events, which are critical to many industries and South African society at large.<\/p>\n\n\n\n
Since the attack, it has been forced to publish weather forecasts and warnings via its social media channels. <\/p>\n\n\n\n
The attack was the work of the Russia-linked group RansomHub, which is known for infiltrating vulnerable systems and networks, stealing data, and encrypting files, leaving organisations locked out of their infrastructure.<\/p>\n\n\n\n
A European Repository of Cyber Incidents (EuRepoC) study found that South Africa was the second most targeted country in Africa regarding cyberattacks against political actors.<\/p>\n\n\n\n
Its analysis detected 21 such incidents in South Africa since 2000, with Egypt being the only country on the continent that suffered more attacks. <\/p>\n\n\n\n
While there have been far more than 21 major cyberattacks in South Africa in the past two decades, EuRepoC only counts incidents that fit certain criteria.<\/p>\n\n\n\n
Firstly, it must violate the CIA triad of information security, meaning the system’s Confidentiality, Integrity, or Availability must have been compromised.<\/p>\n\n\n\n
In addition, the incident must have been publicly reported, have a political dimension, or be against critical infrastructure.<\/p>\n\n\n\n
Minister in the Presidency Khumbduzo Ntshaveni has acknowledged that South Africa is seeing an increase in cybercrime and cyberattacks, with ransomware being the most prevalent threat.<\/p>\n\n\n\n
She said that the issue was affecting both government and private entities. <\/p>\n\n\n\n
Ntshavheni maintained that the State Security Agency was aware of the constant threat of cyberattacks and was attempting to migrate against them.<\/p>\n\n\n\n
Orange Cyberdefense South African managing director Dominic White believes that progress has been made in bringing cybercrime syndicates to justice, thanks to collaboration between law enforcement and cybersecurity experts.<\/p>\n\n\n\n
The table below provides a summary of the major cyberattacks suffered by South African government entities over the past few years. <\/p>\n\n\n\n At least 10 South African government departments or their associated entities have suffered some form of cybercrime or cyberattack in the past five years.<\/p>\n","protected":false},"author":341042,"featured_media":568852,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[72252,1441,15227,5456,199,461,72580,25029],"class_list":["post-580762","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cyberattacks","tag-cybercrime","tag-cybersecurity","tag-government-1","tag-hackers","tag-hacking","tag-ransomware-attack","tag-south-african-weather-service-saws"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/580762"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341042"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=580762"}],"version-history":[{"count":11,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/580762\/revisions"}],"predecessor-version":[{"id":580926,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/580762\/revisions\/580926"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/568852"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=580762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=580762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=580762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Victim<\/th> Date of incident<\/th> Nature of incident<\/th> Alleged perpetrator<\/th> Impact<\/th><\/tr><\/thead> Transnet
Fell under the Department of Public Enterprise, now under Department of Transport<\/td>July 2021<\/td> Ransomware attack<\/td> Likely Russia or Eastern Europe-linked group<\/td> – Broad system lockout, including websites and payroll
– Force majeure declared due to impact on ports clearance systems, causing near standstill in import and export processes<\/td><\/tr>Department of Justice and Constitutional Development (DoJ & CD)<\/td> September 2021<\/td> Ransomware attack<\/td> Unknown<\/td> – DoJ’s e-mail system, bail services, child maintenance payments, online court paper filing, recording and transcription of court proceedings, Master’s Offices taken offline or disrupted
– Switchover to manual systems impacting deceased estates, curatorships, orphan affairs managed by the state
– 1,200 files with personal details of department’s clients compromised<\/td><\/tr>Department of Defence (DoD)<\/td> Starting in 2022<\/td> Data breach with extortion threat<\/td> Snatch<\/td> – 1.6TB data stolen, including military contracts, employee data, and information allegedly related to country’s security
– Data included personal information of President Cyril Ramaphosa<\/td><\/tr>Department of Public Works and Infrastructure (DPWI)<\/td> May, July, and November 2024<\/td> Insider-driven heist<\/td> Unknown<\/td> – Estimated R55 million stolen through rogue payments <\/td><\/tr> Companies and Intellectual Property Commission (CIPC)
Falls under Department of Trade, Industry, and Competition<\/td>Starting from 2021<\/td> Data breach with extortion threat<\/td> Claimed to have no affiliation<\/td> – Passwords and personal information of employees and clients exfiltrated
– Hacker access to company registrations <\/td><\/tr>International Trade Administration Commission of South Africa (ITAC)
Falls under Department of Trade, Industry, and Competition<\/td>January 2024<\/td> Ransomware attack <\/td> Unknown<\/td> – Personal information fo employees, service providers, importers, exporters, and “other stakeholders” potentially stolen<\/td><\/tr> Government Pensions Administration Agency (GPAA)
Falls under Government Employee Pension Fund<\/td>February 2024<\/td> Data breach with extortion threat<\/td> LockBit<\/td> – 668GB data stolen, including personal information of all government employees<\/td><\/tr> National Health Laboratory Service (NHLS)
Falls under Department of Health <\/td>June 2024<\/td> Data breach with extortion threat<\/td> BlackSuit<\/td> – 1.2TB data stolen, including client and patient information
– IT system shutdown affecting emails, website, and lab test result retrieval and storage<\/td><\/tr>South African Social Security Agency (Sassa)
Falls under Department of Social Security <\/td>Unknown<\/td> Identitify theft and digital fraud<\/td> N4aughtySec and others<\/td> – Claimed at least R185 million stolen through fraudulent grant payments<\/td><\/tr> South African Weather Service (SAWS)
Falls under Department of Environmental Affairs<\/td>January 2025<\/td> Ransomware attack<\/td> RansomHub<\/td> – IT system offline, impacting website, emails, and aviation and marine services
– Weather information critical to aviation and marine services provided through alternative channels
– General weather advisories provided over social media<\/td><\/tr><\/tbody><\/table><\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"