SA is under cyber siege — and the situation will only get worse

In February 2024, the Government Pensions Administration Agency (GPAA) – the admin for the Government Employees’ Pension Fund (GEPF) – suffered a cyberattack that forced a shutdown of all systems.

A threat actor, later revealed as LockBit 3.0, breached the GPAA’s Windows environment via unpatched perimeter vulnerabilities or compromised credentials.

Initially, the GEPF (the biggest pension fund on the continent, managing more than R2.38-trillion in assets for 1.7 million active users) denied that it happened, publicly stating that an “attempted” intrusion had occurred, but assuring the public that no data were compromised.

Then LockBit published a 668-gigabyte archive containing records of 168,000 data subjects on its new dark web leak site, and GEPF finally admitted the breach, stating the GPAA had misinformed it.

The complete infrastructure shutdown persisted until 21 June 2024, when platforms were finally brought back online after a total system rebuild. The processing of new retirements, resignations and death benefits was severely delayed, forcing staff to attempt the tasks manually.

That was two months before the two-pot withdrawal system was due to go live – which happened on 1 September 2024, and 361,000 members withdrew R4.1-billion in rapid liquidity.

Harsh reality check

Finance Minister Enoch Godongwana dismissed GPAA CEO Kedibone Madiehe after a disciplinary hearing this month, but the entire saga taught the newly formed Government of National Unity a lesson in cybersecurity.

iGuardSA CEO Yugan Reddy, whose company was the first that the State IT Agency (Sita) called when the breach was discovered, explained the sequence of events to Daily Maverick at GovTech 2026.

He agrees that South Africa has had a rough time since, but refutes the notion that the country is merely passively susceptible, pointing out that its relatively advanced infrastructure makes it uniquely attractive to international attackers:

“We actually have some pretty good infrastructure. Our comms infrastructure is decent. A lot of our systems are developed, and the data is readily available via those systems. So what happens is we become a nice sort of testing ground for the cybercriminals. They almost use us to test a lot of their attacks before they launch them on a first world.”

He corrected himself immediately, because, in his assessment, over the past five years, attackers realised that South Africa is not only a testing ground but an easily monetisable victim pool.

“So we’ve got established infrastructure, everything’s connected, but it’s not protected,” he explained. “In a first-world country, everything's connected but protected. We are just nicely in between for them. So we make things a lot easier for them.”

His main gripe, however, is that while corporate entities allocate about 15% of their IT budgets to cybersecurity, government bodies allocate less than 5%.

Government agencies also rely on systems and applications built 20 to 30 years ago, and inexperienced young engineers are tasked with maintaining legacy environments they have never encountered.

For context

Standard Bank is discovering the extent of the cyberattack in the daily data dumps

April 17, 2026

Sovereignty cart before security horse

Basic cybersecurity frameworks and hygiene principles are largely absent in state IT environments, and Reddy pointed out that “users are our single biggest risk” due to a lack of awareness and accountability.

The government lacks basic policies (like AI usage policies), the enforcement tools, capacity, or skilled personnel within security organs like the State Security Agency to enforce controls. So while the state preaches digital sovereignty on the GovTech stage, it routinely outsources security to foreign OEMs/cloud vendors rather than investing in and cultivating local cybersecurity talent.

This has culminated in targeted attacks on South African government entities over the last year, driven by the incentives of xenophobic attacks and our country’s genocide case against Israel at the International Court of Justice. Another cybersecurity expert told Daily Maverick, on condition of anonymity, that Israeli-linked money was funding the sudden resurgence of Nullsec and its assault on Mzansi’s digital infrastructure.

And that’s before we begin to discuss AI.

“It’s a nightmare for us,” was Reddy’s response to Daily Maverick’s questions about what AI is doing to the cybersecurity industry.

“And if we’re having sleepless nights about it, everybody else out there should be shaking in their boots right now.”

Threat actors use automated AI discovery tools to scan for zero-day vulnerabilities and build functional exploits within seconds. Defenders have zero lead time to patch or configure defences against never-before-seen vectors.

There’s also the growing concern of unregulated employees feeding sensitive corporate and state data into public large language models (LLMs) because of the lack of operating policy, and cybersecurity companies are forced to defend networks where fundamental baseline security controls and policies were never instituted.

Stockholm syndrome

Data from the Sophos State of Ransomware 2026 Reports (surveying 2,158 global cybersecurity leaders, including 135 in South Africa) show how South Africa’s security posture compares to global averages – and it’s not as bad as you would think, but not good either.

Around 47% of South African victims cited a complete lack of protection as their operational root cause – the highest percentage recorded across all 17 surveyed countries, and 85% of South African victims confirmed that their ransomware breach was directly linked to their most significant identity compromise (vs 67% globally).

User devices were the entry point for 43% of non-email attacks.

As for restoration time after a cyberattack? Only 40% of South African businesses recovered within a week, compared with 55% globally; 13% required between one and six months to restore systems.

The GEPF fell firmly in the 13% category, with even President Cyril Ramaphosa’s personal details counted among the credentials stolen.

Communications Minister Solly Malatsi said that a new AI policy will be ready by March 2027, but he and Sita are quiet about statutory mandates requiring state agencies to allocate at least 10-15% of IT budgets specifically to cybersecurity.

At least the iGuardSA stand was directly next to the Sita stand on the GovTech exhibition floor. Which is a good start. DM