{"id":646236,"date":"2026-05-08T14:14:45","date_gmt":"2026-05-08T12:14:45","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=646236"},"modified":"2026-05-10T10:45:14","modified_gmt":"2026-05-10T08:45:14","slug":"r1-6-billion-missing-after-hackers-ran-free-inside-major-south-african-metros-systems","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/646236-r1-6-billion-missing-after-hackers-ran-free-inside-major-south-african-metros-systems.html","title":{"rendered":"R1.1 billion missing after hackers ran free inside major South African metro’s systems"},"content":{"rendered":"\n

The City of Ekurhuleni said it suffered a “digital state of emergency” where R1.19 billion has yet to be recovered after hackers struck the municipality in a long-term cyberattack.<\/p>\n\n\n\n

A delegation from the city told Parliament on Thursday that the breach and resulting account manipulation caused a revenue loss of R2 billion, with only some of the funds recovered.<\/p>\n\n\n\n

According to a briefing to the Standing Committee on Public Accounts (SCOPA), the city discovered the cybercrime during the 2024\/25 financial year when quarterly reports were analysed.<\/p>\n\n\n\n

The city’s executive mayor, Nkosi Xhakaza, and the acting city manager told SCOPA that a dire lack of security at the municipality allowed threat actors to secretly manipulate billing accounts and invoices.<\/p>\n\n\n\n

They discovered that hackers gained access to the city’s internal systems through its government facilities and then either removed debts or paid themselves by generating invoices.<\/p>\n\n\n\n

Tsholofelo Koopedi, Ekurhuleni’s acting city manager, explained that rather than a year-long breach, the attack could have been a series of smaller breaches over time.<\/p>\n\n\n\n

“You could drive to our licence station in Bedfordview, where we have Wi-Fi, and just park outside, and if you are a hacker, you can get access to our VPN and do these things,” he said.<\/p>\n\n\n\n

The delegates said the city’s firewall had collapsed, which created an environment where the account-level manipulation could occur.<\/p>\n\n\n\n

Hackers breached the system and began manipulating bills and invoices. “They get into the system, delete an account of your business where you are owing whatever,” said Koopedi.<\/p>\n\n\n\n

The manipulation of the system went completely undetected at first. The city discovered that contractors were allegedly accessing the system to generate their own fake invoices and pay themselves.<\/p>\n\n\n\n

“It did appear to ourselves that our security infrastructure was deliberately compromised in order to enable this fraudulent activity to take place,” he said.<\/p>\n\n\n\n

Ekurhuleni hack allegedly an inside job<\/h2>\n\n\n\n
\"\"
Nkosindiphile Xhakaza, City of Ekurhuleni executive mayor<\/figcaption><\/figure>\n\n\n\n

Delegates shared that they identified certain individuals who had previously been hired as “consultants” and were allegedly secretly working with outside influences to deliberately undermine the system.<\/p>\n\n\n\n

In one instance, city officials discovered that ICT staffers implemented a loophole where cybersecurity was not monitored at night from 18:00 to 06:00, where manipulation was suspected to take place. <\/p>\n\n\n\n

Jongizizwe Dlabathi, MMC for Finance, said there were whistleblowers within the city who reported that fraud was occurring on a massive scale.<\/p>\n\n\n\n

He said that the city’s finance officials first noticed the problem when they analysed the city’s income against the budget. This began the investigation.<\/p>\n\n\n\n

During the investigation, the city raided its own ICT department and seized around 35 computers for forensic analysis. The matter was reported to the police and the Special Investigating Unit (SIU).<\/p>\n\n\n\n

The investigation also led to the suspension of Moloko Monyepao, the municipality’s chief information officer, on 27 March 2025.<\/p>\n\n\n\n

“This decision arises from serious allegations of mismanagement related to financial losses incurred by the City,” the city said in an announcement<\/a>.<\/p>\n\n\n\n

It said that the suspension stemmed from issues of its billing system, interim meter readings, account manipulations and poor management of business systems.<\/p>\n\n\n\n

Thanks to the investigation, Ekurhuleni successfully identified the compromised accounts and managed to recover a portion of the total losses, around R891 million, through a back-billing process.<\/p>\n\n\n\n

It also implemented several upgrades to its system to restore integrity and prevent future breaches. It brought in the State Security Agency (SSA) for assistance with these upgrades.<\/p>\n\n\n\n

The SSA deployed a 24\/7 security operations centre to monitor systems, as well as enhanced endpoint protection tools, new internal firewalls, and tamper-proof transaction logs.<\/p>\n\n\n\n

In an effort to stop fraudulent payments, the municipality also stopped manual banking updates and now sources invoices to service providers through the Central Supplier Database (CSD).<\/p>\n","protected":false},"excerpt":{"rendered":"

A long spree of undetected hacks saw the City of Ekurhuleni lose over R2 billion. <\/p>\n","protected":false},"author":341213,"featured_media":646240,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[15709,1441,15227,105095,99726,105093,5044,5042,5704,105094],"class_list":["post-646236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-city-of-ekurhuleni","tag-cybercrime","tag-cybersecurity","tag-jongizizwe-dlabathi","tag-moloko-monyepao","tag-nkosi-xhakaza","tag-siu","tag-special-investigating-unit","tag-state-security-agency","tag-tsholofelo-koopedi"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/646236"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341213"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=646236"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/646236\/revisions"}],"predecessor-version":[{"id":646496,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/646236\/revisions\/646496"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/646240"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=646236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=646236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=646236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}