{"id":653461,"date":"2026-06-14T16:59:29","date_gmt":"2026-06-14T14:59:29","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=653461"},"modified":"2026-06-14T17:00:17","modified_gmt":"2026-06-14T15:00:17","slug":"south-african-government-leaving-doors-wide-open-to-cybercriminals","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/653461-south-african-government-leaving-doors-wide-open-to-cybercriminals.html","title":{"rendered":"South African government leaving doors wide open to cybercriminals"},"content":{"rendered":"\n

Hundreds of South African government websites are wide open to cyberattacks thanks to years of poor maintenance and disregard, a cybersecurity researcher has claimed.<\/p>\n\n\n\n

Despite this, the State Information Technology Agency (SITA), which is responsible for a large portion of the government’s ICT infrastructure, previously said that its systems were secure.<\/p>\n\n\n\n

According to a Ground Up<\/a> report, cybersecurity researcher Joel Cedras found hundreds of exploitable vulnerabilities across thousands of government websites hosted by SITA.<\/p>\n\n\n\n

Cedras was part of the team of young researchers that uncovered massive fraud<\/a> in South Africa’s Social Relief of Distress (SRD) grant system in 2024.<\/p>\n\n\n\n

They launched an investigation that revealed the fraud was enabled by a chain of security flaws across several entities in South Africa, including cellular service providers and banks.<\/p>\n\n\n\n

In the latest report, Cedras said that of the 1,100 public-facing systems in SITA’s network, 1 in 7 carry a known security vulnerability that has not yet been patched.<\/p>\n\n\n\n

This problem is even more severe in non-SITA government networks, where 516 public-facing systems were allegedly found to be riddled with exploitable vulnerabilities.<\/p>\n\n\n\n

The network is nearly half the size of the SITA network, yet has nearly as many critical security flaws, with one in five carrying a known vulnerability, he said.<\/p>\n\n\n\n

“Our security operations teams operate on a continuous, 24\/7 basis and are equipped with monitoring and threat-detection capabilities.”<\/p>\n\n\n\n

Tlali Tlali, head of corporate affairs at SITA, previously told MyBroadband that its security operations teams monitor the network 24\/7 and are equipped to handle threats as they arise.<\/p>\n\n\n\n

In new feedback, Tlali told MyBroadband that there are ongoing modernisation initiatives aimed at improving the security posture and performance of critical government systems. <\/p>\n\n\n\n

“Many departments host their systems in their own environments or through approved third-party service providers, while still utilising SITA’s network services for connectivity and secure access.”<\/p>\n\n\n\n

“SITA remains committed to the continual improvement of the Government Private Network (GPN) security posture through the implementation of enhanced security controls,” he said.<\/p>\n\n\n\n

Tlali said that SITA is also implementing proactive monitoring and ongoing cybersecurity improvement initiatives to enhance security across the network. <\/p>\n\n\n\n

Risks of cyberattacks and ransomware on state institutions<\/h2>\n\n\n\n
\"\"
Joel Cedras, cybersecurity researcher<\/figcaption><\/figure>\n\n\n\n

Cedras told MyBroadband that the risk of a SITA-hosted network being struck by a cyberattack was extremely high.<\/p>\n\n\n\n

“I would ask whether it has happened already. Six of the vulnerabilities found were on the Known Exploited Vulnerabilities list,” he said.<\/p>\n\n\n\n

“Both on and off SITA’s network, some government servers have been unpatched for over a decade. The doors are open.”<\/p>\n\n\n\n

He said there are many SITA networks he considers highly vulnerable and susceptible to cyberattacks due to unpatched vulnerabilities.<\/p>\n\n\n\n

Some examples were the Deeds Office, which he discovered had over 450 vulnerabilities. Meanwhile, the Eastern Cape Health Department was found to be vulnerable to a type of attack called ProxyLogon.<\/p>\n\n\n\n

This attack allows attackers to impersonate an admin and get access to their Exchange server and its email, Cedras explained. This could lead to a major data breach or double-extortion attack.<\/p>\n\n\n\n

Other websites ripe for exploitation included those of the Department of Sports, Arts and Culture, which had more than 100 vulnerabilities on a single server.<\/p>\n\n\n\n

The Limpopo Government had more than 150 vulnerabilities on a single server hosting its infrastructure, while the Department of Home Affairs had over 100 open vulnerabilities.<\/p>\n\n\n\n

“The list goes on. And that’s just on SITA’s network!” he said. “There have already been several exploits. More will happen unless the situation is addressed.”<\/p>\n\n\n\n

Statistics South Africa was struck by a ransomware attack<\/a> in May by a group of threat actors called XP95, which vanished from the scene almost as quickly as it emerged.<\/p>\n\n\n\n

The group claimed to have successfully breached the agency and said it stole 154 GB of data from an unspecified Stats SA server.<\/p>\n\n\n\n

XP95 demanded R1.7 million to prevent the leaking of the data it allegedly collected from the server and set a deadline for later that month. Stats SA said that it would not pay.<\/p>\n\n\n\n

Cedras said the risk was that these servers hold data that South African citizens have provided to the government, including identity documents, title deeds, criminal histories, and more.<\/p>\n\n\n\n

“There is a serious risk of leaking of sensitive data, which can facilitate fraud and other crimes against citizens,” he explained.<\/p>\n\n\n\n

“Many of the systems on the network are demonstrably under-maintained and extremely out of date. A ransomware attack could also shut down multiple government services at once.”<\/p>\n\n\n\n

A network-wide ransomware attack through one of SITA’s or the wider government’s unsecured networks would render South Africans unable to use government services.<\/p>\n\n\n\n

Tlali said that SITA recently conducted a security assessment across National and Provincial government departments in conjunction with key government stakeholders. <\/p>\n\n\n\n

“These assessments highlight areas that require remediation to improve security posture, which government departments need to prioritise and work with SITA to address,” he said.<\/p>\n","protected":false},"excerpt":{"rendered":"

A cybersecurity researcher has found that hundreds of websites under SITA are poorly maintained and vulnerable to cyberattacks. <\/p>\n","protected":false},"author":341213,"featured_media":638162,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[105845,96073,105846,30150,4104,17082,5646,103766],"class_list":["post-653461","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-ground-up","tag-joel-cedras","tag-proxylogon","tag-ransomware","tag-sita","tag-state-information-technology-agency","tag-stats-sa","tag-xp95"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/653461"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341213"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=653461"}],"version-history":[{"count":8,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/653461\/revisions"}],"predecessor-version":[{"id":653872,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/653461\/revisions\/653872"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/638162"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=653461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=653461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=653461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}