SITA denied that it had been breached on Sunday. SARS issued a statement on Monday denying that any foreign threat actors compromised its systems.<\/p>\n\n\n\n
\u201cSARS continuously monitors its systems for any suspicious activity and has conducted a thorough investigation in response to these reports,\u201d it said.<\/p>\n\n\n\n
\u201cAt this stage, there is no evidence that SARS\u2019s systems have been compromised. SARS wishes to reassure the public regarding the integrity of its systems.\u201d<\/p>\n\n\n\n
The revenue service said it treated the protection of taxpayer information and the security of its digital platforms as sacrosanct and considers them core responsibilities.<\/p>\n\n\n\n
\u201cThis dovetails with SARS\u2019s broader commitment to build a smart, modern institution with unquestionable integrity, and to strengthen public trust and confidence in the tax administration system,\u201d it said.<\/p>\n\n\n\n
\u201cSARS will continue to monitor its digital environment and, where necessary, will communicate through its official platforms.\u201d<\/p>\n\n\n\n
On 23 May 2026, Nullsec Nigeria, which previously operated under the name Anonymous Nigeria, posted links on a hacker forum to allegedly compromised data from two South African organisations.<\/p>\n\n\n\n
It claimed the SARS data included names, email addresses and passwords used on official websites. The SITA link allegedly contained names, passwords, and the platforms used to access SITA services.<\/p>\n\n\n\n
MyBroadband reported on Sunday that the breach did not appear to be legitimate after a South African cybersecurity researcher analysed the data.<\/p>\n\n\n\n
\u201cIn my opinion, there is not enough information to confirm the SARS and SITA breach claims are real,\u201d they said.<\/p>\n\n\n\n
Nullsec doubles down<\/h2>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2026\/05\/Nullsec-Nigeria-headline-image.jpg\")
Nullsec Nigeria\u2019s logo<\/figcaption><\/figure>\n\n\n\nNullsec Nigeria told MyBroadband via the encrypted messaging service Session that the breaches were real and that it would not leak information belonging to South African citizens.<\/p>\n\n\n\n
\u201cThey\u2019ll deny it or find a way to fix the problem so fast it makes us look like fools. That data is the real data,\u201d they said.<\/p>\n\n\n\n
\u201cAll the documents which were from the hacks are based on ignorance of proper security. The government of South Africa must know those cheap games ain\u2019t a game anymore.\u201d<\/p>\n\n\n\n
MyBroadband could not independently verify the breaches due to insufficient evidence from the Nigerian group.<\/p>\n\n\n\n
SITA head of corporate affairs, Tlali Tlali, said the organisation\u2019s ICT infrastructure had not been compromised and that its systems were fully intact.<\/p>\n\n\n\n
Tlali explained that SITA\u2019s security teams operate 24\/7 and are equipped with monitoring and threat-detection capabilities.<\/p>\n\n\n\n
\u201cAll systems have been tested and verified as fully operational, and no anomalies indicative of a cyberattack have been identified,\u201d the organisation said.<\/p>\n\n\n\n
SITA, which operates the South African government\u2019s digital infrastructure, said that only one significant government organisation\u2019s website was down at the time of its feedback to MyBroadband.<\/p>\n\n\n\n
This was the website of the South African Police Service (SAPS), which we verified was inaccessible at various times on Saturday, 23 May, and Sunday, 24 May.<\/p>\n\n\n\n
\u201cWe wish to clarify that the downtime of a website of that department is the direct result of a scheduled and planned maintenance window,\u201d Tlali said.<\/p>\n\n\n\n
Users visiting the SAPS website received a message that it was unreachable. Nullsec Nigeria posted that the site was \u201ctango down\u201d on its Telegram channel, leading to assumptions that it had attacked the site.<\/p>\n\n\n\n
Nullsec Nigeria told MyBroadband via the encrypted messaging service Session that the breaches were real and that it would not leak information belonging to South African citizens.<\/p>\n\n\n\n
\u201cThey\u2019ll deny it or find a way to fix the problem so fast it makes us look like fools. That data is the real data,\u201d they said.<\/p>\n\n\n\n
\u201cAll the documents which were from the hacks are based on ignorance of proper security. The government of South Africa must know those cheap games ain\u2019t a game anymore.\u201d<\/p>\n\n\n\n
MyBroadband could not independently verify the breaches due to insufficient evidence from the Nigerian group.<\/p>\n\n\n\n
SITA head of corporate affairs, Tlali Tlali, said the organisation\u2019s ICT infrastructure had not been compromised and that its systems were fully intact.<\/p>\n\n\n\n
Tlali explained that SITA\u2019s security teams operate 24\/7 and are equipped with monitoring and threat-detection capabilities.<\/p>\n\n\n\n
\u201cAll systems have been tested and verified as fully operational, and no anomalies indicative of a cyberattack have been identified,\u201d the organisation said.<\/p>\n\n\n\n
SITA, which operates the South African government\u2019s digital infrastructure, said that only one significant government organisation\u2019s website was down at the time of its feedback to MyBroadband.<\/p>\n\n\n\n
This was the website of the South African Police Service (SAPS), which we verified was inaccessible at various times on Saturday, 23 May, and Sunday, 24 May.<\/p>\n\n\n\n
\u201cWe wish to clarify that the downtime of a website of that department is the direct result of a scheduled and planned maintenance window,\u201d Tlali said.<\/p>\n\n\n\n
Users visiting the SAPS website received a message that it was unreachable. Nullsec Nigeria posted that the site was \u201ctango down\u201d on its Telegram channel, leading to assumptions that it had attacked the site.<\/p>\n\n\n\n