Expert says attacks on South African organisations are financially motivated and not aimed at targets of national significance.
An image displaying water pipe and Rand Water logo. Image: Supplied
Cybersecurity experts said this week that the greatest danger posed by a cyberattack on a utility like Rand Water is not contaminated drinking water, but the loss of pressure and control across a gravity-fed network serving millions of people.
Their comments came after Rand Water confirmed a cybersecurity incident that hit its payments and GIS systems. The water utility insisted that water treatment and quality control had continued without interruption.
Worst-case scenario if Rand Water had a deeper cyberattack
Anna Collard, SVP, content strategist, and CISO advisor at KnowBe4, said the scenario most people imagine when they think of a water utility being hacked is actually the hardest for attackers to pull off.
“The dramatic scenario people imagine, like attackers poisoning the water by manipulating chemical dosing, is the hardest to pull off,” she said.
She explained that multiple independent safeguards are in place, including physical dosing limits, redundant sensors, and continuous laboratory testing.
The more realistic danger, Collard said, is attackers locking operators out of control systems, disabling alarms, or shutting down pumping stations.
“Reservoirs draw down in hours, not days,” she said, describing how quickly a gravity-and-pressure-dependent network serving more than 11 million people across Gauteng could be affected.
She added that higher-lying areas would go dry first, and that lost pressure carries a back-siphoning risk that can trigger precautionary boil-water notices.
Bongani Majola, head of DFIR at ScaryByte, offered a starker warning about what a deeper breach of operational technology could mean.
He said attackers with write-access to programmable logic controllers could, in theory, interfere with dosing or induce dangerous pressure surges.
“These physical disruptions can unfold within minutes,” he said, adding that restoring a compromised system could take weeks and leave communities without potable water in the meantime.
The Citizen reached out to the Department of Communications for comment on government’s cybersecurity systems. This article will be updated once comment is received.
Are South Africa’s state entities being targeted, or just exposed?
Both experts pointed to a mix of opportunism and heightened risk.
This comes after questions on whether the country’s state-owned entities are being deliberately targeted by attackers, following Transnet’s 2021 ransomware attack and a wave of attacks on water utilities in the United States this year.
Collard said most attacks on South African organisations are financially motivated and not aimed at targets of national significance.
“They aren’t picking targets off a map of national importance, they’re picking off a list of whoever left the door open,” she said.
She added that state-owned entities are disproportionately represented among victims because they tend to run large, ageing, and technically complex systems.
However, Collard did not entirely rule out a geopolitical dimension.
Referring to attacks on US water systems this year claimed by the group CyberAv3ngers, she said state-aligned actors find water utilities attractive because they are softer targets than the power grid and carry outsized psychological impact.
“South Africa is a BRICS member with an active, visible foreign policy posture, and we should not assume we’re invisible to that kind of actor. But in most cases it’s more likely financially motivated, and I’d caution against jumping to ‘we’re under state attack’ on the current evidence,” she said, adding that the far more common story is that criminals simply found an unlocked door.
Majola described a similar pattern, which he believed operated in two phases.
He said attackers typically started with automated, large-scale scans for unpatched systems or the harvesting of credentials before shifting to a more targeted operation once they realised they had compromised a major public utility.
Citing Transnet’s 2021 attack and past municipal billing shutdowns, he said state-owned entities become primary extortion targets “due to the critical nature of their services” once a breach is confirmed.
What Rand Water says happened, and what experts make of it
Rand Water’s own account of the incident focused on reassurance.
The utility said its treatment processes and quality control systems had continued to operate normally throughout the disruption, and that regular monitoring remained in place to ensure compliance with SANS 241 drinking water standards.
“Our core water delivery mandate continues uninterrupted, and we are committed to restoring full system functionality as quickly as possible,” the utility said.
A thin disclosure, but the right first priority
Collard said Rand Water’s disclosure of the situation was somewhat adequate.
“Rand Water’s statement gets the most important thing right: it addressed the question the public actually cares about, which is whether the water is safe,” she said.
She added that what remains thin is the detail on exactly what was affected, for how long, and whether any personal or vendor data was involved.
Majola said South Africa’s broader track record on technical disclosure after cyberattacks has been poor, with entities often defaulting to minimal statements.
He linked this partly to the absence of a legal mandate forcing more detailed reporting.
“Without a statutory mandate requiring detailed technical reporting, entities weaponise confidentiality to manage brand reputation and public panic,” he argued.
Separation of systems
Experts said that outcome, water quality unaffected while payments and GIS systems were hit, was a reasonable sign that separation between the utility’s IT and OT networks had functioned as intended.
According to Majola, the result suggested a working barrier between the corporate network and the SCADA control loops that manage pumps and valves.
However, he warned that the growing use of IoT sensors and remote monitoring in “smart utilities” is gradually narrowing that gap.
“An attacker who compromises the corporate IT network can move laterally across into the physical OT domain,” he said, if cross-domain connections are not properly secured.
Collard was more cautious about drawing firm conclusions from a single incident.
“There’s a big difference between having a firewall between IT and OT and being able to prove, with testing, that nothing crosses it,” she said.
She said the fact that treatment kept running was “what segmentation looks like when it holds,” but stressed that this does not confirm the boundary would survive a more determined attack.
Underinvestment and a fragmented legal framework
Both experts pointed to chronic underinvestment as a structural weakness across South African public utilities.
Collard said cybersecurity spending routinely loses out to competing priorities such as pipe replacement and load shedding mitigation, because the risk involved “is invisible until it isn’t.”
She said governance was the cheapest problem to fix, arguing that cyber risk should sit on utility boards alongside water quality and infrastructure failure.
“If cyber isn’t on the board’s risk register next to water quality and infrastructure failure, it will never get the attention or the funding,” she said.
Meanwhile, Majola raised a related concern about the skills required to defend both IT and OT environments.
He said public entities cannot compete with private sector salaries for specialists, and argued that partnerships with outside digital forensics firms can help close the gap.
“These entities provide the military-grade incident response, continuous threat hunting, and prosecution-ready evidence preservation necessary to protect critical infrastructure,” he said.
On regulation, both experts agreed that South Africa lacks a law compelling utilities to disclose operational incidents that do not involve personal data.
Collard said oversight of the sector is fragmented across bodies with little enforcement power, and pointed to the European Union’s NIS2 directive, which requires reporting within 24 hours, as a possible model.
Majola noted that mandatory reporting provisions under the Cybercrimes Act remain suspended for general utilities, leaving obligations inconsistent across the sector.
What experts say should happen next
Collard urged utilities to identify and immediately close any internet-exposed control systems.
She cited this year’s US water attacks as evidence that initial access is often gained through poorly secured equipment accessible via the public internet.
She also called for regular rehearsal of manual plant operations.
“Get your control systems off the public internet, prove you can run without them, and make sure your people know what an attack looks like before it arrives”.
Majola called for stricter audits of IT-OT segmentation and the use of immutable, offline backups for critical data and blueprints.
He said such measures, combined with specialist forensic support, would allow utilities “to rebuild encrypted servers swiftly, eliminating the need to negotiate with criminal syndicates.”
