South Africa\u2019s flagship supercomputer consists of Dell servers powered by Intel processors, using FDR InfiniBand by Mellanox, and is managed by the Bright Cluster Manager.<\/p>\n\n\n\n
The cluster is capable of over a quadrillion (1,000 trillion) floating-point operations per second (FLOPS), also called a petaflop.<\/p>\n\n\n\n
The supercomputer has been upgraded substantially over the past 10 years, and while it achieved petaflop performance, it did not meet the CSIR\u2019s goal of expanding to 40,000 cores.<\/p>\n\n\n\n
It consists of 1,368 compute nodes with 32,832 cores, 5 large memory \u201cfat\u201d nodes, 9 GPU nodes, and 4 petabytes of storage using the Lustre parallel file system.<\/p>\n\n\n\n
Each standard node has 64GB or 128GB of memory and runs on a 24-core 2.6GHz Intel Xeon processor, while the fat nodes have 1TB of RAM with a 56-core 2.2GHz processor.<\/p>\n\n\n\n
The 9 GPU nodes feature a 36-core 2.2GHz Intel Xeon processor, 32GB of system memory, and an Nvidia V100 graphics card with 16GB or 32GB of video RAM.<\/p>\n\n\n\n
Lengau has a total memory capacity of 148.5TB, plus the additional 5TB from the fat nodes. It has a theoretical peak performance of 1.307 petaflops and achieved an Rmax of 1.029 petaflops in Linpack.<\/p>\n\n\n\n
NiceHash\u2019s profitability calculator indicated that although the 9 GPU nodes would only earn a modest R51 per day, the 1,368 compute cores could generate thousands of rands in Monero (XMR) per day.<\/p>\n\n\n\n
Monero is a cryptocurrency designed to be private and untraceable, making it a perfect option for hackers stealing computer time on South Africa\u2019s premier supercomputer.<\/p>\n\n\n\n
Lengau hacked twice in one week<\/h2>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2026\/06\/Lengau-HPC-cluster-supercomputer-CSIR-CHPC-1200x675.jpg\")
<\/figure>\n\n\n\nThis is the second time in a week that Lengau was hacked. Users first noticed problems on 25 May 2026, when there were performance issues across the cluster.<\/p>\n\n\n\n
\u201cAn immediate shutdown of the nodes was performed, and all nodes were re-imaged to its original state before releasing to users again,\u201d the CHPC told users two days after the incident.<\/p>\n\n\n\n
\u201cThe CHPC is investigating the cause of the suspected compromise and will report further on this once more information is confirmed.\u201d<\/p>\n\n\n\n
However, another attack on Saturday, 30 May, forced the CHPC to take the supercomputer offline again. It initially estimated that it would take up to two days to investigate the breach.<\/p>\n\n\n\n
\u201cThis is to allow the CHPC to investigate the incident, secure the environment, and implement additional hardening measures to better protect the platform and user data,\u201d it said.<\/p>\n\n\n\n
That same day, the organisation told users that the Lengau HPC cluster remained isolated from incoming and outgoing Internet access to contain the breach.<\/p>\n\n\n\n
From its preliminary investigations, the CHPC said it could confirm that user cluster information, including usernames, passwords, private keys, and data stored on the filesystem, was likely compromised.<\/p>\n\n\n\n
\u201cThis thus represents a serious security breach, and the CHPC is focused on investigating this properly and to follow all regulatory processes required for such incidents,\u201d it said.<\/p>\n\n\n\n
\u201cThat includes reporting this to relevant privacy and POPIA entities within the CSIR and externally.\u201d<\/p>\n\n\n\n
The CHPC said the investigation to determine the cause and the steps needed to prevent another breach required the Lengau cluster to remain offline significantly longer than initially anticipated.<\/p>\n\n\n\n
\u201cAt the very least, it will remain offline for several days, but it can also be for a week or two,\u201d the CHPC said.<\/p>\n\n\n\n
As of Tuesday, 2 June 2026, Lengau remained offline, including the Lustre parallel file system, which meant user data was unavailable.<\/p>\n\n\n\n
\u201cAccess will only be restored once the file system has been fully restarted and reopened to users,\u201d the CHPC said.<\/p>\n\n\n\n
\u201cBased on current estimates, Lengau is expected to remain unavailable for the next 7 days until at least 8 June 2026, although this date may change depending on the progress of the recovery process.\u201d<\/p>\n\n\n\n
MyBroadband contacted the CSIR for comment on the security breach, but it had not provided feedback by the deadline.<\/p>\n\n\n\n
Following publication, the CSIR provided a statement assuring that there was no evidence that user research data had been compromised.<\/p>\n\n\n\n
\u201cMitigation measures were implemented without delay to address the unauthorised access, and additional security controls are being deployed to strengthen the environment,\u201d it said.<\/p>\n\n\n\n
\u201cWe plan to complete the investigation into this incident soon so that we can restore high-performance computing services to users as quickly and safely as possible.\u201d<\/p>\n\n\n\n
The CSIR also assured that the CHPC Lengau computing cluster was separate from the rest of the institution\u2019s Information and Communication Technology infrastructure.<\/p>\n\n\n\n
\u201cTherefore, the CSIR\u2019s own research data and business information systems were not affected by this breach.\u201d<\/p>\n\n\n\n
\n\n\n\nPhoto of one of Lengau\u2019s racks<\/h2>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2026\/06\/Lengau-full-rack-600x800.jpg\")
<\/figure>\n\n\n\n
\n","protected":false},"excerpt":{"rendered":"Hackers infiltrated South Africa’s top supercomputer and used it to mine cryptocurrency, the Centre for High Performance Computing has told users.<\/p>\n","protected":false},"author":15,"featured_media":651543,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,27],"tags":[20103,20101,37541],"class_list":["post-651536","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hardware","category-security","tag-centre-for-high-performance-computing-chpc","tag-council-for-scientific-and-industrial-research-csir","tag-lengau-cluster"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=651536"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions"}],"predecessor-version":[{"id":652019,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions\/652019"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/651543"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=651536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=651536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=651536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/figure>\n\n\n\nThis is the second time in a week that Lengau was hacked. Users first noticed problems on 25 May 2026, when there were performance issues across the cluster.<\/p>\n\n\n\n
\u201cAn immediate shutdown of the nodes was performed, and all nodes were re-imaged to its original state before releasing to users again,\u201d the CHPC told users two days after the incident.<\/p>\n\n\n\n
\u201cThe CHPC is investigating the cause of the suspected compromise and will report further on this once more information is confirmed.\u201d<\/p>\n\n\n\n
However, another attack on Saturday, 30 May, forced the CHPC to take the supercomputer offline again. It initially estimated that it would take up to two days to investigate the breach.<\/p>\n\n\n\n
\u201cThis is to allow the CHPC to investigate the incident, secure the environment, and implement additional hardening measures to better protect the platform and user data,\u201d it said.<\/p>\n\n\n\n
That same day, the organisation told users that the Lengau HPC cluster remained isolated from incoming and outgoing Internet access to contain the breach.<\/p>\n\n\n\n
From its preliminary investigations, the CHPC said it could confirm that user cluster information, including usernames, passwords, private keys, and data stored on the filesystem, was likely compromised.<\/p>\n\n\n\n
\u201cThis thus represents a serious security breach, and the CHPC is focused on investigating this properly and to follow all regulatory processes required for such incidents,\u201d it said.<\/p>\n\n\n\n
\u201cThat includes reporting this to relevant privacy and POPIA entities within the CSIR and externally.\u201d<\/p>\n\n\n\n
The CHPC said the investigation to determine the cause and the steps needed to prevent another breach required the Lengau cluster to remain offline significantly longer than initially anticipated.<\/p>\n\n\n\n
\u201cAt the very least, it will remain offline for several days, but it can also be for a week or two,\u201d the CHPC said.<\/p>\n\n\n\n
As of Tuesday, 2 June 2026, Lengau remained offline, including the Lustre parallel file system, which meant user data was unavailable.<\/p>\n\n\n\n
\u201cAccess will only be restored once the file system has been fully restarted and reopened to users,\u201d the CHPC said.<\/p>\n\n\n\n
\u201cBased on current estimates, Lengau is expected to remain unavailable for the next 7 days until at least 8 June 2026, although this date may change depending on the progress of the recovery process.\u201d<\/p>\n\n\n\n
MyBroadband contacted the CSIR for comment on the security breach, but it had not provided feedback by the deadline.<\/p>\n\n\n\n
Following publication, the CSIR provided a statement assuring that there was no evidence that user research data had been compromised.<\/p>\n\n\n\n
\u201cMitigation measures were implemented without delay to address the unauthorised access, and additional security controls are being deployed to strengthen the environment,\u201d it said.<\/p>\n\n\n\n
\u201cWe plan to complete the investigation into this incident soon so that we can restore high-performance computing services to users as quickly and safely as possible.\u201d<\/p>\n\n\n\n
The CSIR also assured that the CHPC Lengau computing cluster was separate from the rest of the institution\u2019s Information and Communication Technology infrastructure.<\/p>\n\n\n\n
\u201cTherefore, the CSIR\u2019s own research data and business information systems were not affected by this breach.\u201d<\/p>\n\n\n\n
\n\n\n\n
Photo of one of Lengau\u2019s racks<\/h2>\n\n\n\n<\/figure>\n\n\n\n
\n","protected":false},"excerpt":{"rendered":"Hackers infiltrated South Africa’s top supercomputer and used it to mine cryptocurrency, the Centre for High Performance Computing has told users.<\/p>\n","protected":false},"author":15,"featured_media":651543,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,27],"tags":[20103,20101,37541],"class_list":["post-651536","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hardware","category-security","tag-centre-for-high-performance-computing-chpc","tag-council-for-scientific-and-industrial-research-csir","tag-lengau-cluster"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=651536"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions"}],"predecessor-version":[{"id":652019,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions\/652019"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/651543"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=651536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=651536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=651536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/figure>\n\n\n\n\n","protected":false},"excerpt":{"rendered":"
Hackers infiltrated South Africa’s top supercomputer and used it to mine cryptocurrency, the Centre for High Performance Computing has told users.<\/p>\n","protected":false},"author":15,"featured_media":651543,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,27],"tags":[20103,20101,37541],"class_list":["post-651536","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hardware","category-security","tag-centre-for-high-performance-computing-chpc","tag-council-for-scientific-and-industrial-research-csir","tag-lengau-cluster"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=651536"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions"}],"predecessor-version":[{"id":652019,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/651536\/revisions\/652019"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/651543"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=651536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=651536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=651536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}