Cyberattack at credit regulator means its performance targets couldn’t be verified

The finances of the National Credit Regulator (NCR) are in order, but exactly what it got up to in 2025 couldn’t be fully assessed by the Auditor-General of South Africa (AG).

The regulator’s annual report, discussed in parliament in the past week, was flagged by internal auditors and the AG for material misstatements because it couldn’t verify performance targets due to a cyberattack. The NCR did however receive an unqualified audit because its finances were auditable and verifiable.

The cyberattack occurred in 2025, before new CEO Otsile Maseng joined in 2026.

Read/listen:
Third-party cyber risks emerge as weak link for banks after data breach concerns
SA earns top spot as target for cyber attacks

The NCR oversees the country’s entire credit industry, including the lending practices of the country’s largest banks, micro-lenders and large retail firms.

Consumer credit – referring to current open loans – sits at R2.7 trillion, according to the 2026 Q1 Eighty20/XDS Credit Stress Report.

Information ‘lost’

Auditor-General Tsakani Maluleke explains in the NCR’s annual report she could not verify if it had reached certain performance targets.

ADVERTISEMENT

CONTINUE READING BELOW

“The unavailability of supporting performance information for some indicators in Quarter 1 and Quarter 2 was caused by a cyberattack and by management’s failure to establish and maintain secure, isolated and effective off-site backup arrangements to safeguard critical information and ensure its recoverability in the event of a system disruption.”

The internal auditors who reviewed the report also flagged the inability to verify if performance targets were reached, mainly because supporting information was lost during the cyberattack.

The AG describes the loss of data as due to “significant internal control deficiencies”.

It concludes that “management did not implement and maintain adequate record-keeping to ensure that complete, relevant, accurate and readily accessible information was available to support performance reporting”.

Watch/read:
Tsakani Maluleke: From supermarket till to Auditor-General
AI tool that hacked Korean Banks was used in Japan, GMO says
The crypto devices built to foil hackers came with spies inside

The areas the AG could not assess for accuracy:

The number of investigations conducted on credit providers relating to the National Credit Act;
Enforcement actions taken as a percentage of investigations which identified non-compliance with the National Credit Act (NCA);
The number of investigations conducted on debt counsellors relating to compliance with the NCA; and
Enforcement actions taken on non-compliant debt counsellors.

“Cyberattacks on businesses and government are becoming more frequent and more sophisticated,” says RiXForensica director Riaan van Jaarsveld.

This is partly because artificial intelligence (AI) has made attacks much easier to carry out, he adds.

ADVERTISEMENT:

CONTINUE READING BELOW

“The question is no longer whether an organisation will be attacked, but whether it is prepared when it happens.”

He explains: “You can’t stop every attack, but you can make yourself a much harder target. Simple things go a long way: a second step when logging in, keeping software up to date, teaching staff to spot a dodgy email, and keeping a safe copy of your data.”

Read:
Old Mutual client data exposed in service provider error
How Gauteng’s new panic app exposed your data
EasyEquities, Satrix hit by data breach

Danny Myburgh – a digital forensics expert, founder of Digital Forensics Lab and North West University professor who works with the police, the government and large listed companies – says he does not know why the South African government is still targeted as it has to date never paid a ransom to hackers.

The government also has far less valuable information than the private sector, he adds.

Greater ‘operational resilience’ needed

Ian Jansen van Rensburg, head of security engineering at Check Point Software, says in many cases the public sector “still has legacy systems or constrained security resources”.

“On the regulator matter specifically, it would be inappropriate to conclude from the annual report alone exactly how the incident occurred or whether controls failed without the forensic findings.

“However, the reported loss or unavailability of information highlights an important distinction: cybersecurity is not only about preventing an initial intrusion, but about operational resilience and the ability to recover trustworthy data.”

ADVERTISEMENT:

CONTINUE READING BELOW

NCR response

According to CEO Maseng, the incident showed the need for the NCR to strengthen its digital systems, which he says it has done.

“While the NCR had information technology systems and backup in place at the time of the incident, the cyber-attack highlighted the need to strengthen its digital infrastructure, information security, and business continuity arrangement.”

He says the NCR accepts that its mandate requires dependable record-keeping and robust information security, and it remains committed to constantly taking precautionary steps across its operations and ensuring that its information security environment is not compromised.

He points out that while the attack showed vulnerability within the organisation, it highlighted the growing risks facing organisations globally.

Maseng says “significant progress” has since been made “in restoring affected systems and strengthening the [NCR’s] digital environment, including protection and improving data governance”. 

“Cyber-attack threats have become one of the most significant operational risks faced by regulators, banks, multinational corporations,” he adds, noting that major financial institutions have themselves experienced security incidents and data breaches in 2026.

#Cyberattack #credit #regulator #means #performance #targets #couldnt #verified