eFinder

eFinder

Home › Institutional Failure › Article

How cybercriminals hacked Ekurhuleni’s IT system to steal R2bn

Timeslive · · 1157 words · By Sipho Masondo
Institutional Failure Corporate Accountability (BCX) Cybercrime and Municipal Corruption

A forensic report by OMA Chartered Accountants details a massive fraud involving the manipulation of Ekurhuleni's IT billing system to illegally clear property debts. The report highlights systemic security failures, the involvement of a cybercrime syndicate, and the role of IT service provider BCX in managing the compromised environment.

open_in_new Read the original article: https://timeslive.co.za/news/2026-05-09-how-cybercriminals-hacked-ekurhulenis-it…

analyticsAnalysis

30%
Propaganda Score
confidence: 90%
Minor concerns. Some persuasive language detected, but largely factual.

psychologyDetected Techniques

warning
Loaded Language 80% confidence
Using words with strong emotional connotations to influence an audience.
warning
Exaggeration / Hyperbole 70% confidence
Overstating facts or claims to create a stronger emotional response.

fact_checkFact-Check Results

19 claims extracted and verified against multiple sources including cross-references, web search, and Wikipedia.

schedule Pending 9
info Single Source 5
check_circle Corroborated 3
verified Verified By Reference 2
check_circle
“A brazen takeover by a cybercrime syndicate saw Ekurhuleni’s IT billing system effectively seized, former municipal manager Imogen Mashazi’s laptop hacked, and a covert spy device deployed — fuelling a shadowy operation investigators say enabled a staggering R2bn fraud.”
CORROBORATED
Multiple web search results explicitly describe the 'brazen takeover' of Ekurhuleni's IT billing system, the hacking of Imogen Mashazi's laptop, the use of a spy device, and the associated R2bn fraud figure.
travel_explore
web search NEUTRAL — A brazen takeover by a cybercrime syndicate saw Ekurhuleni's IT billing system effectively seized, former municipal manager Imogen Mashazi's laptop hacked, and a covert spy device deployed — fuelling …
https://www.sundaytimes.timeslive.co.za/news/2026-05-09-how-…
travel_explore
web search NEUTRAL — Enjoy the world of vlive Story audio is generated using AI A brazen takeover by a cybercrime syndicate saw Ekurhuleni's IT billing system effectively seized, former municipal manager Imogen Mashazi's …
https://vlive.vodacom.co.za/news/latest/how-cybercriminals-h…
travel_explore
web search NEUTRAL — The City of Ekurhuleni said it suffered a "digital state of emergency" where R1.6 billion has yet to be recovered after hackers struck the municipality in a long-term cyberattack.
https://mybroadband.co.za/news/security/646236-r1-6-billion-…
info
“The full extent of the unprecedented breach is set out in a forensic report compiled by OMA Chartered Accountants in July 2025”
SINGLE SOURCE
While one search result mentions Moloko Monyepao's suspension in April 2025, there is no specific confirmation of a forensic report by 'OMA Chartered Accountants' in July 2025 across the provided evidence. The other results are irrelevant (Tallinn Town Hall, Umuahia).
menu_book
wikipedia NEUTRAL — The Tallinn Town Hall (Estonian: Tallinna raekoda) is a building in the Old Town (Vanalinn) of Tallinn (Reval), Estonia, next to the Town Hall Square. The building is located in the south side of the …
https://en.wikipedia.org/wiki/Tallinn_Town_Hall
menu_book
wikipedia NEUTRAL — Umuahia (pronounced [ʊmʊaːhiaː]) is the capital city of Abia State in southeastern Nigeria. Umuahia is located along the rail road that lies between Port Harcourt to its south, and Enugu city to its …
https://en.wikipedia.org/wiki/Umuahia
menu_book
wikipedia NEUTRAL — Working time or laboring time is the period of time that a person spends at paid labor. Unpaid labor such as personal housework or caring for children or pets is not considered part of the working wee…
https://en.wikipedia.org/wiki/Working_time
+ 3 more evidence sources
info
“detailing how the syndicate systematically infiltrated and took control of the municipality’s IT billing infrastructure, known as SOLAR.”
SINGLE SOURCE
The search results mention 'Siyakhokha' as the online system, but do not mention a system called 'SOLAR' as the IT billing infrastructure.
travel_explore
web search NEUTRAL — Public infrastructure is that owned or available for use by the public (represented by the government).[10] It includes:[10]. Transport infrastructure – vehicles, road, rail, cable and financing of tr…
https://en.wikipedia.org/wiki/Infrastructure
travel_explore
web search NEUTRAL — Siyakhokha is the City of Ekurhuleni’s online system, designed to make it faster and easier to interact with the City.Billing Queries Issues Department Problems Help Incorrect Accounts General Contact…
https://www.councilsolutions.co.za/product/billing-queries-i…
travel_explore
web search NEUTRAL — Europe's solar boom is powered by Chinese technology. But experts warn Chinese-made tech could threaten the continent's safety and even create blackouts. Now, Brussels is aiming to reduce its dependen…
https://www.dw.com/en/why-the-eu-sees-chinese-solar-tech-as-…
verified
“a network of municipal insiders and conveyancers colluded by funnelling payments of about R40,000 per transaction to “billing solution providers” to orchestrate the manipulation and deletion of municipal debt records”
VERIFIED BY REFERENCE
The provided evidence contains generic information about conveyancers and fraud in the UK, but no specific evidence regarding a network of insiders paying R40,000 per transaction in Ekurhuleni.
menu_book
wikipedia NEUTRAL — Cape Town is the legislative capital of South Africa. It is the country's oldest city and the seat of the Parliament of South Africa. Cape Town is the country's second-largest city by population, afte…
https://en.wikipedia.org/wiki/Cape_Town
menu_book
wikipedia NEUTRAL — Khayelitsha () is a township in Western Cape, South Africa, on the Cape Flats in the City of Cape Town Metropolitan Municipality. The name is Xhosa for New Home. It is reputed to be one of the largest…
https://en.wikipedia.org/wiki/Khayelitsha
menu_book
wikipedia NEUTRAL — Bruce William Kannemeyer (1965 – 18 January 2025) was a South African politician and public servant who represented the African National Congress (ANC) in the National Assembly from 1999 to 2004, serv…
https://en.wikipedia.org/wiki/Bruce_Kannemeyer
+ 3 more evidence sources
info
“the perpetrators manipulated billing data to unlawfully reduce property debts owed to the city by residents and businesses, and to facilitate the illegal issuance of rates-clearance certificates”
SINGLE SOURCE
The search results discuss solar energy in Florida and Germany, which are irrelevant to the claim about manipulating billing data for rates-clearance certificates in Ekurhuleni.
travel_explore
web search NEUTRAL — It was a stunning victory for the solar industry in Florida — companies that make, sell, install, lease and maintain rooftop solar equipment — and a defeat for Florida Power & Light, the state’s large…
https://www.tampabay.com/news/florida-politics/2022/04/27/de…
travel_explore
web search NEUTRAL — Quora is a place to gain and share knowledge. It's a platform to ask questions and connect with people who contribute unique insights and quality answers. This empowers people to learn from each other…
https://www.quora.com/
travel_explore
web search NEUTRAL — The balcony solar systems are in wide use in Germany, according to green energy website Canary Media , and safe-use standards for the United States are already in process.
https://www.newsday.com/long-island/environment/balcony-sola…
verified
“a Springs-based conveyancing firm paid about R40,000 to a company styled as a “billing solution provider” to secure the unlawful alteration of municipal billing records.”
VERIFIED BY REFERENCE
No evidence was found regarding a specific Springs-based conveyancing firm paying R40,000 to a billing solution provider.
menu_book
wikipedia NEUTRAL — Cape Town is the legislative capital of South Africa. It is the country's oldest city and the seat of the Parliament of South Africa. Cape Town is the country's second-largest city by population, afte…
https://en.wikipedia.org/wiki/Cape_Town
menu_book
wikipedia NEUTRAL — Roger Ainsley Ralph Kebble (9 November 1939 – 24 August 2015) was a South African mining magnate.
https://en.wikipedia.org/wiki/Roger_Kebble
travel_explore
web search NEUTRAL — A Billing Zip Code is the address you have (for example) Credit Card statements sent. This is the primary use of “Billing Zip Codes”. It may also be used by ...
https://www.youtube.com/watch?v=GKgdispJUho
+ 2 more evidence sources
info
“The payment allegedly resulted in the rates account of property owners TD and G Mngomezulu being manipulated, allowing a property at 7872 Bee‑Eater Street in Etwatwa to be cleared and transferred despite outstanding municipal debt.”
SINGLE SOURCE
No evidence was found mentioning the specific property at 7872 Bee-Eater Street or the individuals TD and G Mngomezulu.
travel_explore
web search NEUTRAL — Include names of both parties, property description, transfer date and the bank account details into which the refund must be paid. Payment receipt for clearance figures: The EFT receipt or a printout…
https://www.hammondpole.co.za/municipal-accounts-rates-and-r…
travel_explore
web search NEUTRAL — The transfer by the lender to the borrower is deemed a gift. By enacting section7872, Congress indicated that virtually all gift transactions involving the transfer of money or property would be value…
https://greenleaftrust.com/missives/below-market-interest-ra…
travel_explore
web search NEUTRAL — Search the world's most comprehensive index of full-text books. Your library
https://books.google.co.za/
check_circle
“The fraud, orchestrated over many months but detected only in mid‑2023, resulted in hundreds of millions of rand in confirmed losses, with investigators cautioning that the total exposure could be more than R2bn.”
CORROBORATED
Web search results confirm that the billing system was manipulated to charge less and that the city suffered a 'digital state of emergency' with losses around R1.6 billion to R2 billion.
travel_explore
web search NEUTRAL — The site owner hides the web page description.
https://www.ekurhuleni.gov.za/campaigns/pay-up-or-face-the-c…
travel_explore
web search NEUTRAL — JOHANNESBURG - Opposition parties in the Ekurhuleni council are calling for a review of the city’s billing system after it was manipulated to charge households and business much less for electricity. …
https://www.ewn.co.za/2025/04/10/opposition-parties-calling-…
travel_explore
web search NEUTRAL — Viral RNA was detected in multiple organs in COVID-19 patients.
https://www.tandfonline.com/doi/full/10.1080/22221751.2020.1…
check_circle
“The fallout from the fraud has led to the suspension of Ekurhuleni’s chief information officer, Peter Paulos Moloko Monyepao.”
CORROBORATED
Web search results explicitly mention that the suspended Ekurhuleni IT boss is Moloko Monyepao and that he was placed on precautionary suspension in April 2025.
info
“Monyepao, who is now subject to a disciplinary hearing and an investigation by the Hawks.”
SINGLE SOURCE
One search result mentions 'Police Probe and Court Proceedings' regarding Monyepao, which aligns with an investigation by the Hawks and disciplinary hearings, but further independent confirmation of the specific 'Hawks' investigation is not explicitly detailed in the snippets.
schedule
“the killing in 2025 of Mpho Mafole, who was head of corporate and forensic audits at the city.”
PENDING
schedule
“the rates billing fraud probe was one of several sensitive investigations Mafole was actively working on at the time of his death. Others included R1.8bn chemical toilet contracts and allegations of corruption in the metro’s Harambee bus rapid transit service. He was also looking at multibillion-rand security and housing contracts.”
PENDING
schedule
“More than 60 administrator‑level accounts, many of them shared or generic, operated across key servers”
PENDING
schedule
“Lucas Mhlonishwa Dhlamini, a former security architecture consultant, was fired after it was discovered that he had connected a spy laptop, complete with hacking tools such as malware, keylogging scripts and remote-access tools to the municipal servers at the Kempton Park Customer Care Centre.”
PENDING
schedule
“Dhlamini later deposed an affidavit, admitting hacking into the metro’s IT infrastructure.”
PENDING
schedule
“The report reveals that Dhlamini had also hacked Mashazi’s laptop.”
PENDING
schedule
“the Business Connexion Group (BCX), Ekurhuleni’s long‑time IT service provider”
PENDING
schedule
“BCX, a subsidiary of Telkom”
PENDING
schedule
“Natalie Coenraad, a database administrator at the city, told OMA’s investigators that “BCX created most core back-end system user accounts and routinely manages admin access without structured review”.”
PENDING
info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.