CyphrQ
Menu

South Africa Justice Department Ransomware and the R5m POPIA Fine

Ransomware hit South Africa's Justice Department in 2021. The regulator found lapsed security licences and later issued a R5 million POPIA fine.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: September 20219 min read

What happened to South Africa's Department of Justice in 2021? Ransomware encrypted its IT systems in September 2021. The Information Regulator later found that the department had let its SIEM, intrusion detection and antivirus licences expire in 2020, and that about 1,204 files were lost. When the department did not comply with the resulting enforcement notice, the Regulator issued a R5 million administrative fine.

This is a case file built only from official sources: the Information Regulator's own statements, the department's statements, and the text of the Protection of Personal Information Act (POPIA). Where those sources are silent, we say so.

Case file

Field Value (official source)
Organisation Department of Justice and Constitutional Development (DoJ&CD)
Region South Africa (Sub-Saharan Africa)
Breach date September 2021 (Information Regulator)
Decision date Enforcement notice 9 May 2023; infringement notice 3 July 2023 (Information Regulator)
People affected Not published. The Regulator reports the loss of "approximately 1204 files"
Data types Personal information (categories not published)
Penalty R5 million administrative fine
Regulator Information Regulator (South Africa)
Status Challenged in court by the department; "pending a hearing" as of 13 November 2025 (Information Regulator)

What happened at the Department of Justice, and when?

The Regulator's enforcement statement says that "in September 2021 the DoJ&CD suffered a security compromise on its IT systems," which made the department's systems unavailable to employees and affected services to the public (Information Regulator, 10 May 2023).

The department itself called it ransomware. Its own media archive lists a 9 September 2021 statement titled "The Department of Justice's IT system attacked by Ransomware" (DoJ&CD media archive). The government news agency later reported that "the department's IT systems were encrypted and unavailable to officials and the public" (SAnews, 11 October 2021).

The impact on services was real. A 20 September update said Master's Offices would issue "no manual letters of executorship or authority" during the crisis, and that courts had moved to manual operation of the Court Recording Technology systems (gov.za, 20 September 2021). By 11 October the department said the spread of the malware had been contained and some online services restored (SAnews).

What data was affected, and how many people?

The official figures are about files, not people.

  • The department said a high-level assessment of "1 200 files containing personal information that may have been compromised during the attack" had been finalised (SAnews, 11 October 2021).
  • The Regulator's later finding refers to "the loss of approximately 1204 files" (Information Regulator).
  • On 4 October 2021 the department published a Director-General "notification regarding potential compromises of personal information of a data subject" under POPIA (DoJ&CD media archive). We could not open the text of that notice, so we do not describe its contents.

Neither source gives a number of people affected or lists the categories of personal information in those files. Any headcount you see elsewhere did not come from these official statements.

How did the Justice Department ransomware attack happen, per official reports?

The official record does not describe how the attackers got in. It does describe why they were not seen, and why the investigation was hampered.

The Regulator found that the department "had failed to put in place adequate technical measures to monitor and detect unauthorised exfiltration of data from their environment" (Information Regulator). It named three lapsed licences:

Control What the Regulator found Consequence it described
SIEM (the Regulator writes "Security Incident and Event Monitoring") Licence expired in 2020 and was not renewed No monitoring of unusual network activity, no backup of log files, and "unavailability of critical information contained in the log files"
Intrusion Detection System Licence expired in 2020 and was not renewed No alerts "of suspicious activity by unauthorised people accessing the network"
Trend antivirus Licence expired in 2020 and was not renewed Virus definitions "for known malware threats not being updated"

A SIEM (security information and event management system) collects logs from across a network so a team can spot and investigate attacks. Without it, the department lost both early warning and the evidence trail.

The Regulator also found a governance failure: the department did not identify reasonably foreseeable risks, did not maintain safeguards against them, and did not "regularly verify and update the security safeguards against malware threats" (Information Regulator).

The enforcement happened in two steps, and the R5 million fine came from the second.

Step 1: enforcement notice (9 May 2023). After an own-initiative assessment, the Regulator found the department had contravened sections 19 and 22 of POPIA (Information Regulator). In the official text of POPIA:

  • Section 19 requires a responsible party to take "appropriate, reasonable technical and organisational measures" to prevent loss of, and unlawful access to, personal information. Section 19(2) lists the steps: identify foreseeable risks, maintain safeguards, regularly verify them, and update them.
  • Section 22 requires notifying the Regulator and affected people "as soon as reasonably possible" when there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person. The Regulator's statement does not say which part of section 22 the department breached.

The notice ordered the department to prove within 31 days that the Trend antivirus, SIEM and intrusion detection licences had been renewed, and to start disciplinary proceedings against the officials who failed to renew them.

Step 2: infringement notice and fine (3 July 2023). The 31 days expired on 9 June 2023. The Regulator said the department had sent no implementation report "or any other communication", and had not used its right to appeal under section 97(1) (Information Regulator, 4 July 2023). It issued an administrative fine of R5 million and gave the department 30 days to pay, arrange instalments, or elect to be tried in court.

Under POPIA, failing to comply with an enforcement notice is an offence (section 103(1)), and section 109 lets the Regulator issue an infringement notice with a fine that may not exceed R10 million (POPIA). So the fine punished the non-response to the order, not the ransomware attack directly.

Where it stands. In its 13 November 2025 briefing, the Regulator said the department "challenged this in court. The matter is pending a hearing" (Information Regulator). We found no later official update before publishing.

Is this case unusual in South Africa?

No. The same briefing shows the Regulator using the same two-step route against others, and a steep rise in reported breaches (Information Regulator, 13 November 2025):

  • Lancet Laboratories received an R100,000 fine after failing to comply with an enforcement notice. The underlying problem was not notifying the Regulator or affected people about security compromises, as section 22 requires. The Regulator confirmed the fine was paid.
  • The Department of Basic Education received an R5 million infringement notice over the publication of matric results; that dispute is also in court.
  • Breach notifications: 2,374 security compromises were reported in the 2024/25 financial year. From April 2025 to the briefing date, 1,947 were reported, which the Regulator describes as a 40% increase.

Going deeper: for security and IT teams

Threat model. A financially motivated ransomware operator needs one foothold and enough unobserved time to stage, exfiltrate and encrypt. The official record does not give the initial access vector, so we do not guess one. What it does establish is the end state: data loss (around 1,204 files, described as unauthorised exfiltration) and encryption of department systems, with no working SIEM, IDS or current antivirus signatures in place.

Mapping to MITRE ATT&CK. Only the stages the official sources support:

Stage ATT&CK technique Link to this case
Exfiltration T1041 Exfiltration Over C2 Channel (one common route; the actual channel was not published) Regulator: no measures "to monitor and detect unauthorised exfiltration"
Impact T1486 Data Encrypted for Impact Systems "encrypted and unavailable"
Impact T1490 Inhibit System Recovery Typical of ransomware; MITRE notes it is often paired with T1486. Not confirmed in this case
Defence evasion T1562.001 Impair Defenses: Disable or Modify Tools Here the defences were already off. Expired licences give an attacker the same result for free

The control failures, as stated. All three are POPIA section 19(2)(c) and (d) problems, "regularly verify" and "continually updated". They were not missing products. They were products whose licences lapsed. That is an asset- and contract-management failure as much as a security one.

Licensing as a security control. Treat every security-tool licence as a control with an owner, an expiry date and an alert:

  • Keep a register of security subscriptions (EDR/antivirus, SIEM, IDS/IPS, email filtering, backup) with renewal dates, a named owner and a budget line.
  • Alert 90, 60 and 30 days before expiry, and escalate to risk owners, not only to procurement.
  • Know what each product does on expiry. Some stop updating signatures but keep running. That looks healthy on a dashboard and is the failure the Regulator described for the antivirus.

Logging and evidence. The Regulator tied the SIEM lapse to losing "critical information contained in the log files". Make sure logs are retained independently of the SIEM licence: forward them to separate, access-controlled storage with a retention period that covers your breach-investigation and section 22 notification needs.

Backups. MITRE lists M1053 Data Backup as a mitigation for T1490. Keep at least one copy offline or immutable, and test restoring it. The department's 20 September 2021 update describes manual workarounds for courts, which shows how long recovery can take.

Detection signals to alert on:

  • A security agent or SIEM source going silent. Alert on "no events from host or source in N hours", not just on bad events.
  • Antivirus signature age above your threshold, reported per endpoint.
  • Use of vssadmin.exe, wbadmin.exe or bcdedit.exe to delete shadow copies, backup catalogues or recovery settings. MITRE names all three under T1490.
  • Large or unusual outbound transfers from file servers, especially to new destinations.

What to verify in your own estate:

  1. Can you list every security subscription and its expiry date today, in one place?
  2. Does a lapsed licence trigger an alert to someone who owns the risk?
  3. If your SIEM stopped tomorrow, would you still have 90 days of logs elsewhere?
  4. When did you last restore a full system from an offline backup?
  5. If a regulator asked for proof of renewal within 31 days, could you produce invoices and console screenshots in a day?

Key takeaways

  • Ransomware hit South Africa's Justice Department in September 2021. The Regulator says about 1,204 files were lost. No count of affected people has been published.
  • The Regulator found the SIEM, intrusion detection and antivirus licences had all expired in 2020, and that this breached POPIA sections 19 and 22.
  • The R5 million fine (3 July 2023) was for ignoring the 9 May 2023 enforcement notice, not a direct fine for the attack. POPIA caps such fines at R10 million.
  • The department has challenged the decision in court. As of 13 November 2025 the matter was pending a hearing.
  • The practical lesson is boring and cheap: track security licences like the controls they are, alert when telemetry goes quiet, and keep logs and backups that survive a lapse.

This week: pull your security-tool renewal dates into one list, assign an owner to each, and set an alert 90 days before every expiry.

Sources