SABC Hacked in Business Email Compromise

SABC hacked headlines shocked South Africans this week after the state broadcaster confirmed that several staff email accounts had been compromised in a cybersecurity incident. The breach is part of a growing pattern of attacks against government institutions and state-owned enterprises.

According to Mmoni Ngubane, Head of Communications at the South African Broadcasting Corporation (SABC), the IT team acted swiftly to secure the compromised mailboxes. “The SABC is aware of a recent email compromise affecting a small number of employee accounts,” Ngubane told MyBroadband.

While the threat was contained quickly, the event underscores the increasing danger of business email compromise (BEC), a sophisticated cyberattack method that targets employees through seemingly legitimate communication to gain access to sensitive systems or data.

Timeline of the SABC Hacked Email Compromise

MyBroadband received reports of suspicious emails from the SABC’s domain on two separate dates — first on Monday, 28 July 2025, and again on Thursday, 31 July 2025. The emails appeared to originate from a stakeholder relationships manager and a senior executive, respectively.

These incidents led to the discovery of the broader breach and the immediate activation of internal cybersecurity incident response protocols.

Ngubane confirmed that the event had been isolated and fully resolved but also emphasized that the broadcaster continues to educate its staff about cybersecurity best practices and maintains strict vigilance against future threats.

Cybercriminals Target South African Institutions

The SABC hacked incident is not an isolated case. In 2025 alone, several high-profile entities have suffered significant cybersecurity incidents:

• South African Airways reported a serious attack in May 2025, disrupting its website and mobile application access.

• The National Treasury discovered malware on its Infrastructure Reporting Model system, likely linked to broader Microsoft SharePoint platform exploits.

The National Treasury engaged Microsoft directly to investigate and resolve the vulnerabilities, emphasizing the critical need for collaboration with global tech partners in national security matters.

South Africa Faces 3,000+ Cyberattacks Weekly

According to the 2025 Telecommunications Sector Report by the Communications Risk Information Centre (Comric), South Africa’s government infrastructure suffers approximately 3,312 cyberattacks each week.

The report highlights several concerning trends:

• Ransomware attacks are the most common type of breach.

• South Africa loses approximately R2.2 billion annually to cybercrime.

• The average cost of a data breach reached R50 million in 2023.

Ransomware attacks typically encrypt data and demand payment for a decryption key. These attacks, often devastating, can halt operations and cause reputational damage. Minister in the Presidency Khumbudzo Ntshavheni recently warned that ransomware and business email compromise incidents were rising dramatically.

Phishing, Malware, and Identity Fraud on the Rise

In addition to ransomware, South Africa has seen a dramatic spike in other forms of cybercrime, including:

• Phishing scams, which cost businesses R200 million in 2023.

• Synthetic identity fraud and malware-based exploits.

• Sophisticated business email compromise tactics targeting executives.

The SABC hacked incident is a textbook example of how criminals exploit digital communication channels. Emails sent from the broadcaster’s official domain looked authentic, and in many BEC cases, employees unknowingly assist attackers by opening links or attachments.

Public Entities Must Prioritize Cybersecurity Readiness

Experts warn that as cybersecurity incidents increase, especially against state-owned entities, response protocols must evolve. 66% of companies surveyed by Comric reported taking active steps to mitigate risks, while the remaining third remain dangerously unprepared.

This is especially critical as more public services move online and digital transformation accelerates. In this context, ransomware attacks and email compromises are not just IT problems — they are threats to national stability and service delivery.

What South Africans Should Learn from the SABC Hack

While the SABC hacked event was contained, it offers several lessons for both public and private sectors:

1. Cyber awareness training is essential. Employees at all levels must be able to identify phishing and suspicious communications.

2. Two-factor authentication (2FA) should be standard on all work email systems.

3. Regular audits and penetration testing must be done to identify and resolve vulnerabilities before they’re exploited.

4. Public communication during a breach should be transparent and prompt to maintain trust and control misinformation.

The incident also shows that business email compromise is not just a big business or government problem — smaller organizations are also at risk and should invest accordingly.

The Growing Cybersecurity Industry in South Africa

The silver lining to South Africa’s cyber challenges is the booming cybersecurity industry. With demand rising, Comric projects the sector will grow to R73 billion by 2030.

This growth offers opportunities for:

• Startups in threat detection and AI-driven security.

• Public-private partnerships for critical infrastructure protection.

• Local upskilling programs to train cybersecurity professionals.

As these efforts scale, South Africa may eventually become a continental leader in digital defense.

Conclusion

The SABC hacked incident is a wake-up call. While state entities continue to digitize and modernize, they remain attractive targets for increasingly sophisticated cybercriminals. From ransomware attacks to business email compromise, the threat landscape in South Africa is evolving rapidly.

It is no longer a question of if a breach will happen — but when. The best defense lies in preparation: investing in systems, training, response strategies, and national cooperation.

The cybersecurity incident at the SABC may have been contained, but the broader war against cybercrime is far from over.

Here are five mainstream South African media references supporting the topics of SABC hacked, cybersecurity incident, business email compromise, and ransomware attacks, each with links:

1. MyBroadband

Article: SABC confirms staff email accounts were hacked in business email compromise
Link: https://mybroadband.co.za/news/security/520156‑sabc‑confirms‑staff‑email‑accounts‑were‑hacked.html
Relevance: Direct reporting on the SABC email compromise incident. Facebook+3X (formerly Twitter)+3Facebook+3

2. BusinessTech

Article: Treasury hit by cyberattack — confirms malware breach
Link: https://businesstech.co.za/news/government/710214/treasury-hit-by-cyberattack-confirms-malware-breach/
Relevance: Details on National Treasury’s malware incident linked to rising cyber‑risks. TechCabalTaylor & Francis Online

3. Engineering News (via BusinessTech Africa)

Article: Cybercrime Surge: South Africa faces 3,312 weekly cyberattacks, heavy ransomware impact
Link: https://www.businesstechafrica.co.za/telecoms/2025/07/22/comric‑telecommunications‑sector‑report‑2025/
Relevance: COMRIC 2025 report providing stats on ransomware attacks, phishing and broader threats. Business Tech Africa

4. News24 / Fin24

Article: SAA confirms cyberattack hit online systems — operations unaffected
Link: https://www.news24.com/fin24/companies/saa-confirms-cyberattack-hit-online-systems-but-flight-operations-not-affected-20250506
Relevance: Covers South African Airways’ cybersecurity incident and containment measures. TechCabal

5. INTERPOL (reported widely in Reuters-style coverage)

Article: New INTERPOL report warns of sharp rise in cybercrime in Africa
Link: https://www.interpol.int/en/News-and-Events/News/2025/New-INTERPOL-report-warns-of-sharp-rise-in-cybercrime-in-Africa
Relevance: Highlights continent‑wide rise in ransomware, BEC, phishing and other cyber threats.