Argieffoto (Foto: South African Tourism / Flickr via Wikimedia Commons)
Hackers are believed to have looted around R2 billion from the Ekurhuleni metro’s invoicing system by manipulating this system over a period of time and illegally changing debt records.
The DA says the directorate for priority crime investigations (the Falcons) is investigating several municipal officials about their alleged role in the theft. According to the FF Plus, the scale of the alleged cybercrime indicates a “total management collapse” in the metro.
Khathutshelo Rasilingwane, the DA’s mayoral candidate for Ekurhuleni, says the party will pres. Cyril Ramaphosa requested in writing to announce an investigation by the Special Investigation Unit (SUE) into the matter.
According to him, there must be clear timelines for the initiation and completion of the investigation, as well as the prompt referral of evidence for criminal prosecution where violations are confirmed.
“This case goes beyond a technical offence. Under Mayor Nkosindiphile Xhakaza, oversight and accountability in the city collapsed and weak controls were allowed to continue. This created an environment in which public money could be looted with few consequences.”
The DA says its latest action follows a complaint that the party already submitted to the SOE in July 2025 about the disappearance of the money and the systematic defects that apparently made it possible.
According to the party, the latest developments, including the Hawks’ investigation and information that emerged from parliament’s standing committee on public accounts (Skoor), emphasized the urgency of action.
The DA also expressed concern over the killing of Mpho Mafole, a senior municipal official who was apparently involved in internal investigations into the missing money.
Mafole was the metro’s head of forensic audit. According to the DA, there are allegations that he compiled evidence in connection with the case.
“Any possible connection remains the subject of an investigation and must be treated with the utmost seriousness,” says Rasilingwane.
Denise Janse van Rensburg, FF Plus councilor in the Ekurhuleni metro council, says Skoor’s revelations about the alleged cybercrime are once again proof of mismanagement in the ANC-led coalition.
According to Janse van Rensburg, hackers have apparently breached the metro’s billing system repeatedly by using unprotected Wi-Fi at the licensing department in Bedfordview.
She says spyware was allegedly installed from vehicles outside the building, after which passwords were stolen and debt records were systematically manipulated.
“This led to the illegal forgiveness of debts and the issuance of tariff clearance certificates.”
According to her, an independent forensic report already warned in July 2025 that internal collusion and poor IT controls made the attacks possible.
“Despite these warnings, the ANC-led administration failed to act in time.”
Janse van Rensburg says residents are already struggling with poor service delivery, roads full of potholes, water and power outages, high rates and poor debt collection.
“While residents struggle with these problems on a daily basis, billions of rands of taxpayers’ money have simply disappeared.”
The FF Plus demands a full, independent forensic investigation into all IT transactions, account manipulation and payments over the relevant period.
“The public and the council have the right to know exactly what went wrong and who was responsible.”
Janse van Rensburg says all relevant officials, contractors and political leaders must be made known. According to her, anyone who was involved in fraud, corruption or negligence should be prosecuted.
The FF Plus also calls for the metro’s cyber security to be urgently strengthened through independent monitoring and regular audits of all financial and administrative systems.