Rand Water suffered a cybersecurity incident, which has allegedly crippled its payments software and geographic information system.
Rand Water has suffered a cybersecurity incident, which has allegedly crippled its payment software and geographic information system (GIS).
The company told MyBroadband it was preparing a statement regarding the incident. MyBroadband became aware of the incident through an anonymous source.
Rand Water is the largest bulk water supplier in South Africa. The state-owned company is also the largest water utility on the African continent.
Its stated mission is to deliver and supply affordable, reliable, high-quality water and related services to South African citizens and other stakeholders.
As one of the largest bulk water utilities in the world, the company provides bulk potable water to more than 11 million people in Gauteng, parts of Mpumalanga, the Free State and North West.
Rand Water draws water from its catchments and purifies it for human consumption, supplying water to municipalities, mines and industries.
The Johannesburg-based utility is at the centre of a large-scale systemic water crisis in Gauteng, which also involves the local municipal distributors such as Johannesburg and Tshwane Water.
Municipalities across Gauteng have experienced water shortages and taps running dry at different times for several years, stemming from widespread infrastructure collapse and mismanagement.
Rand Water, in particular, has been blamed for failing to meet the province’s residents’ water demand, with blanket water restrictions often imposed.
However, the shortages are often not due to Rand Water being unable to supply enough water, but because municipalities have not contracted enough supply from the bulk utility.
The scale of the infrastructure and supply challenges in Gauteng also meant that large parts of the province were impacted for extended periods during maintenance programmes.
In January, residents in parts of Gauteng were hit with a 52-hour water outage as Rand Water completed the final phase of a large-scale scheduled maintenance programme.
“Due to the interconnected nature of the systems, a secondary impact may occur in the other neighbouring areas,” the City of Johannesburg said at the time.
A source that contacted MyBroadband alleged that a cyberattack had struck Rand Water, which affected its payments to vendors and contractors.
The incident also allegedly took down Rand Water’s GIS system. This system is a specialised database used by the utility to map, monitor, and manage its water infrastructure across the country.
The source said the outage meant any company requiring approval to build infrastructure could not obtain it, as Rand Water could not tell contractors how to avoid its pipes.
Rand Water operates 13 tertiary pumping stations, 60 service reservoirs and secondary booster stations, as well as a 3,500km pipeline network worth multiple billions of rands.
The utility is the latest large-scale South African state-owned company to experience disruptions due to a cyber incident.
In 2021, port and rail company Transnet was struck by a ransomware attack that encrypted its systems and caused widespread chaos across the organisation, including weeks-long delays at ports.
The cyberattack forced Transnet to declare force majeure at its container terminals and switch to manual cargo processing across the country.
Employees at Transnet were told not to use their laptops, desktops or tablets connected to Transnet’s domain. Staff were also told not to access their work emails immediately following the attack.
It was believed that the company was crippled by a ransomware strain known as “Death Kitty”, also known as “Hello Kitty” and “Five Hands.”
Transnet followed the South African government’s policy of not paying ransoms to threat actors and did not pay the ransom, even as its operations ground to a halt.
The late Pravin Gordhan, who was public enterprises minister at the time, revealed that Transnet’s IT systems were only 90% recovered two months after the attack.
