<\/p>\n
The finances of the National Credit Regulator (NCR) are in order, but exactly what it got up to in 2025 couldn\u2019t be fully assessed by the Auditor-General of South Africa (AG).<\/p>\n
The regulator\u2019s annual report, discussed in parliament in the past week, was flagged by internal auditors and the AG for material misstatements because it couldn\u2019t verify performance targets due to a cyberattack. The NCR did however receive an unqualified audit because its finances were auditable and verifiable.<\/p>\n
The cyberattack occurred in 2025, before new CEO Otsile Maseng joined in 2026.<\/p>\n
Read\/listen:
Third-party cyber risks emerge as weak link for banks after data breach concerns
SA earns top spot as target for cyber attacks<\/p>\n
The NCR oversees the country\u2019s entire credit industry, including the lending practices of the country\u2019s largest banks, micro-lenders and large retail firms.<\/p>\n
Consumer credit \u2013 referring to current open loans \u2013 sits at R2.7 trillion, according to the 2026 Q1 Eighty20\/XDS Credit Stress Report.<\/p>\n
Information \u2018lost\u2019<\/p>\n
Auditor-General Tsakani Maluleke explains in the NCR\u2019s annual report she could not verify if it had reached certain performance targets.<\/p>\n
ADVERTISEMENT<\/p>\n
CONTINUE READING BELOW<\/p>\n
\u201cThe unavailability of supporting performance information for some indicators in Quarter 1 and Quarter 2 was caused by a cyberattack and by management\u2019s failure to establish and maintain secure, isolated and effective off-site backup arrangements to safeguard critical information and ensure its recoverability in the event of a system disruption.\u201d<\/p>\n
The internal auditors who reviewed the report also flagged the inability to verify if performance targets were reached, mainly because supporting information was lost during the cyberattack.<\/p>\n
The AG describes the loss of data as due to \u201csignificant internal control deficiencies\u201d.<\/p>\n
It concludes that \u201cmanagement did not implement and maintain adequate record-keeping to ensure that complete, relevant, accurate and readily accessible information was available to support performance reporting\u201d.<\/p>\n
Watch\/read:
Tsakani Maluleke: From supermarket till to Auditor-General
AI tool that hacked Korean Banks was used in Japan, GMO says
The crypto devices built to foil hackers came with spies inside<\/p>\n
The areas the AG could not assess for accuracy:<\/p>\n
The number of investigations conducted on credit providers relating to the National Credit Act;
\nEnforcement actions taken as a percentage of investigations which identified non-compliance with the National Credit Act (NCA);
\nThe number of investigations conducted on debt counsellors relating to compliance with the NCA; and
\nEnforcement actions taken on non-compliant debt counsellors.<\/p>\n
\u201cCyberattacks on businesses and government are becoming more frequent and more sophisticated,\u201d says RiXForensica director Riaan van Jaarsveld.<\/p>\n
This is partly because artificial intelligence (AI) has made attacks much easier to carry out, he adds.<\/p>\n
ADVERTISEMENT:<\/p>\n
CONTINUE READING BELOW<\/p>\n
\u201cThe question is no longer whether an organisation will be attacked, but whether it is prepared when it happens.\u201d<\/p>\n
He explains: \u201cYou can\u2019t stop every attack, but you can make yourself a much harder target. Simple things go a long way: a second step when logging in, keeping software up to date, teaching staff to spot a dodgy email, and keeping a safe copy of your data.\u201d<\/p>\n
Read:
Old Mutual client data exposed in service provider error
How Gauteng\u2019s new panic app exposed your data
EasyEquities, Satrix hit by data breach<\/p>\n
Danny Myburgh \u2013 a digital forensics expert, founder of Digital Forensics Lab and North West University professor who works with the police, the government and large listed companies \u2013 says he does not know why the South African government is still targeted as it has to date never paid a ransom to hackers.<\/p>\n
The government also has far less valuable information than the private sector, he adds.<\/p>\n
Greater \u2018operational resilience\u2019 needed<\/p>\n
Ian Jansen van Rensburg, head of security engineering at Check Point Software, says in many cases the public sector \u201cstill has legacy systems or constrained security resources\u201d.<\/p>\n
\u201cOn the regulator matter specifically, it would be inappropriate to conclude from the annual report alone exactly how the incident occurred or whether controls failed without the forensic findings.<\/p>\n
\u201cHowever, the reported loss or unavailability of information highlights an important distinction: cybersecurity is not only about preventing an initial intrusion, but about operational resilience and the ability to recover trustworthy data.\u201d<\/p>\n
ADVERTISEMENT:<\/p>\n
CONTINUE READING BELOW<\/p>\n
NCR response<\/p>\n
According to CEO\u00a0Maseng, the incident showed the need for the NCR to strengthen its digital systems, which he says it has done.<\/p>\n
\u201cWhile the NCR had information technology systems and backup in place at the time of the incident, the cyber-attack highlighted the need to strengthen its digital infrastructure, information security, and business continuity arrangement.\u201d<\/p>\n
He says the NCR accepts that its mandate requires dependable record-keeping and robust information security, and it remains committed to constantly taking precautionary steps across its operations and ensuring that its information security environment is not compromised. <\/p>\n
He points out that while the attack showed vulnerability within the organisation, it highlighted the growing risks facing organisations globally. <\/p>\n
Maseng says \u201csignificant progress\u201d has\u00a0since been made \u201cin restoring affected systems and strengthening the [NCR\u2019s] digital environment, including protection and improving data governance\u201d.\u00a0<\/p>\n
\u201cCyber-attack threats have become one of the most significant operational risks faced by regulators, banks, multinational corporations,\u201d he adds, noting that major financial institutions have themselves experienced security incidents and data breaches in 2026.<\/p>\n
#Cyberattack #credit #regulator #means #performance #targets #couldnt #verified<\/p>\n","protected":false},"excerpt":{"rendered":"
The finances of the National Credit Regulator (NCR) are in order, but exactly what it…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[1645,2535,5626,1511,2123,9237,956,23970],"_links":{"self":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts\/19547"}],"collection":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19547"}],"version-history":[{"count":0,"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts\/19547\/revisions"}],"wp:attachment":[{"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}