As cyber attacks on water utilities intensify, Rand Water – Africa’s largest bulk water utility – has had its network infiltrated and is still trying to determine the extent of the damage.
It is now operating in a disaster recovery environment.
In a statement issued on the JSE’s Stock Exchange News Service yesterday, the utility said it was “responding to a cyber security incident affecting certain information technology systems”. It adds that “the incident is being actively investigated and managed with the support of relevant internal and external specialists”.
Rand Water, based in the south of Johannesburg, adds: “Its critical operational activities, including water treatment processes, water quality control systems and bulk water supply operations, remain fully operational and continue to function normally.”
The entity, which serves more than 16 million people across Gauteng, parts of the Free State, North West and Mpumalanga, says it continues to monitor and test water quality to ensure its drinking water remains safe and meets the required standards.
Too late, they cried
Speaking with ITWeb, Rand Water’s debt officer, Lucky Ncobela, explains that hackers took advantage of the cover of dark to penetrate its network, gaining access to some servers. He notes the utility is still in the process of determining which areas of the entity were affected.
“Our IT guys, they identified it at night. They saw… if I can call it an intruder, tapping into our system. And when they identified it, they tried to block everything. But unfortunately, it was [too] late,” Ncobela says. “There were some servers that were damaged.”
However, says Ncobela, Rand Water has a disaster recovery (DR) site in Centurion, just south of Pretoria and north of Midrand, which is now in use, ensuring business continuity.
“We are currently using the DR site as our main centre while we sanitise everything in our office and replace it,” Ncobela says, noting this is in a bid to avoid the virus spreading.
Ncobela notes that, without the backup disaster recovery centre “we were going to be in big trouble”. He adds that the treasury unit was already a remote operation, so the transactional side of the business was not impacted.
Alistair Pugin, founder of cloud technology enabler @Celyntis, says that, based on Rand Water’s explanation, it seems the attack “was malicious in its intent” and aimed “to bring down systems” rather than a ransomware attack.
Seizing control
This breach comes as hackers increasingly turn their attention to utilities, with Ncobela saying they are targeting energy and water entities on a more regular basis. “Therefore, I think as we are the biggest water board, we were also targeted.”
At the end of July, the Federal Bureau of Investigation stated that malicious cyber actors were targeting water and wastewater sector internet-facing programmable logic controllers, causing operational disruptions. The US Cyber Security and Infrastructure Security Agency says “threat actors are targeting water entities of all sizes”.
Writing for The Conversation early last month, William Akoto, assistant professor of global security at the American University School of International Service, said: “Hackers tried to break into at least 30 municipal water systems in Minnesota on 26 to 27 July 2026. Since then, Michigan, New Jersey and several other states have reported similar cyber attacks.”
Akoto adds: “The attackers did not try to infiltrate the computers that utility offices use. Instead, they tried to seize control of small computers in equipment like pumps and valves that deliver drinking water to millions of people.”
An August 2021 International Journal of Water Resources Development paper states that 20 known cases of cyber crime attacks on water utilities had been seen in five countries between 2000 and 2021, with a steady increase in their frequency. “The actual number of cyber attacks is higher,” writes researcher David Owen.
These attacks are “chiefly driven by organised crime and hostile state actors, along with disgruntled former employees,” writes Owen.
Pugin notes: “Typically, a threat actor lives inside an organisation for months before they get detected.”
Share
