Xneelo could not reveal who was responsible for the website. We asked Xneelo to relay an invitation to comment to its customer, but the company or individual did not come forward.<\/p>\n\n\n\n
MyBroadband asked whether the attackers exploited a vulnerability in the Zondo Commission\u2019s web application or Xneelo\u2019s server.<\/p>\n\n\n\n
\u201cThe website in question is hosted on a self-managed service, which means we have no visibility of what\u2019s on the hosted server,\u201d an Xneelo spokesperson said.<\/p>\n\n\n\n
\u201cHowever, we will pass your details on to the customer so they can decide whether they would like to respond directly.\u201d<\/p>\n\n\n\n
MyBroadband also contacted the State IT Agency (SITA) for comment, which said SITA neither hosted nor maintained the Zondo Commission\u2019s website.<\/p>\n\n\n\n
Further investigation revealed that the State Capture website was developed using CodeIgniter, an open-source PHP rapid web development framework.<\/p>\n\n\n\n
The Internet Archive\u2019s Wayback Machine shows that the site has been online since at least September 2020.<\/p>\n\n\n\n
It is unclear whether it has been patched to close security vulnerabilities discovered in CodeIgniter in the past five years.<\/p>\n\n\n\n
The purpose of the compromise remains unclear, although one likely explanation is that the hackers wanted to use it as an attack site targeting Indonesian consumers.<\/p>\n\n\n\n
Cyberattacks on the rise in South Africa<\/h2>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2025\/08\/State-Capture-website-hack-752x800.jpg\")
Screenshot of the Indonesian online gambling platform the State Capture website linked to for a few days.<\/figcaption><\/figure>\n\n\n\nThe Zondo Commission is one of many South African entities targeted by cyberattacks this year. In the past eight months, attackers have targeted companies and government agencies across various sectors.<\/p>\n\n\n\n
Earlier this month, a cyber extortion group called INC Ransom claimed responsibility for breaching Altron Netstar\u2019s corporate network<\/a> and leaking 505GB of data onto the dark web.<\/p>\n\n\n\nIn May, ransomware gang Everest Group claimed responsibility for an attack on Mediclinic<\/a>, stating that they exfiltrated 4GB of data and the personal data of 1,000 employees.<\/p>\n\n\n\nThat same week, Adidas South Africa notified customers that it suffered a data breach<\/a> with people\u2019s names, email addresses, phone numbers, genders, and birth dates potentially exposed.<\/p>\n\n\n\nIn the telecommunications sector, MTN<\/a> and Cell C<\/a> reported data breaches earlier this year, with Cell C confirming that it was the victim of a ransomware attack by a group called RansomHouse.<\/p>\n\n\n\nWhile Cell C was up-front and provided details about the attack it suffered, MTN was more tight-lipped, only saying that some people in certain markets were affected.<\/p>\n\n\n\n
Astral Foods<\/a>, South Africa\u2019s largest chicken producer, Eastplats<\/a>, a prominent mining company, and Pam Golding<\/a>, the largest real estate company in the country, all disclosed data breaches this year.<\/p>\n\n\n\nIn addition, in July, Microsoft SharePoint became the target of a zero-day vulnerability, which caused headaches for organisations worldwide.<\/p>\n\n\n\n
SharePoint is a widely used web-based platform developed by Microsoft for collaboration and document management.<\/p>\n\n\n\n
The security flaw allowed attackers to access SharePoint servers and steal keys that let them impersonate users or services. This could enable deep access into compromised networks to steal confidential data.<\/p>\n\n\n\n
The Zondo Commission is one of many South African entities targeted by cyberattacks this year. In the past eight months, attackers have targeted companies and government agencies across various sectors.<\/p>\n\n\n\n
Earlier this month, a cyber extortion group called INC Ransom claimed responsibility for breaching Altron Netstar\u2019s corporate network<\/a> and leaking 505GB of data onto the dark web.<\/p>\n\n\n\n In May, ransomware gang Everest Group claimed responsibility for an attack on Mediclinic<\/a>, stating that they exfiltrated 4GB of data and the personal data of 1,000 employees.<\/p>\n\n\n\n That same week, Adidas South Africa notified customers that it suffered a data breach<\/a> with people\u2019s names, email addresses, phone numbers, genders, and birth dates potentially exposed.<\/p>\n\n\n\n In the telecommunications sector, MTN<\/a> and Cell C<\/a> reported data breaches earlier this year, with Cell C confirming that it was the victim of a ransomware attack by a group called RansomHouse.<\/p>\n\n\n\n While Cell C was up-front and provided details about the attack it suffered, MTN was more tight-lipped, only saying that some people in certain markets were affected.<\/p>\n\n\n\n Astral Foods<\/a>, South Africa\u2019s largest chicken producer, Eastplats<\/a>, a prominent mining company, and Pam Golding<\/a>, the largest real estate company in the country, all disclosed data breaches this year.<\/p>\n\n\n\n In addition, in July, Microsoft SharePoint became the target of a zero-day vulnerability, which caused headaches for organisations worldwide.<\/p>\n\n\n\n SharePoint is a widely used web-based platform developed by Microsoft for collaboration and document management.<\/p>\n\n\n\n The security flaw allowed attackers to access SharePoint servers and steal keys that let them impersonate users or services. This could enable deep access into compromised networks to steal confidential data.<\/p>\n\n\n\n