Microsoft SharePoint Cyberattack Shakes South African Institutions

Hackers hit Treasury, car manufacturer, and university as South Africa becomes collateral in global cyber war

South Africa has become the latest casualty in a sweeping global cyberattack that exploited a serious flaw in Microsoft’s SharePoint servers, leaving government departments, local authorities, and even academic institutions exposed.

The National Treasury confirmed this week that malware was detected on its Infrastructure Reporting Model website, a clear sign that not even the nation’s core financial systems are off-limits to today’s digital intruders. While the Treasury says there have been no disruptions to operations, the breach is part of a wider crisis affecting at least 400 organisations globally.

A Broader Breach With Local Impact

According to Dutch cybersecurity firm Eye Security, which first flagged the attack last week, victims include a diverse list: from a South African car manufacturer and a university to multiple local-government departments and a federal agency. The firm declined to name the affected organisations, citing privacy concerns, but confirmed that two additional, still-unidentified South African entities have also been compromised.

Internationally, the United States accounts for the majority of the breaches, but South Africa joins a list of other affected nations such as Mauritius, Jordan, and the Netherlands.

The SharePoint Flaw: What Went Wrong?

At the heart of the attack is a vulnerability in on-premise Microsoft SharePoint servers, widely used across South Africa for internal document collaboration, particularly by government departments that prioritise data control and self-hosting for security reasons.

Ironically, this setup, once considered more secure, has become the primary target. Microsoft has clarified that only on-premise users are affected, not clients who rely on their cloud-based SharePoint services.

While Microsoft has yet to release a formal statement, the breach underscores a growing dilemma for institutions relying on legacy IT infrastructure.

A Wake-Up Call for Public and Private Sectors

In a country already grappling with digital transformation and IT skill shortages, this breach is more than just a technical mishap, it’s a wake-up call. Local Twitter (X) users expressed frustration at how outdated public systems have left the nation vulnerable. “Why are we still using old SharePoint servers in 2025?” one user asked. “The cyberthreats are evolving, but our systems aren’t.”

Cybersecurity analysts warn that the full scope of the breach may still be unfolding. Given how many South African entities use SharePoint for everything from procurement to internal audits, this incident could expose sensitive government and corporate data.

A History of Warning Signs

This isn’t the first time South Africa has found itself under digital siege. In recent years, entities like Transnet and the Department of Justice have also suffered high-profile cyberattacks. Despite those alarms, slow migration to more secure cloud systems and a lack of dedicated cyber defence strategies have left gaps wide open.

The fact that the Treasury itself, a critical node in national financial oversight was infiltrated, albeit mildly, speaks volumes.

Next Steps and Urgency

The details of the attack have been shared with South Africa’s Computer Security Incident Response Team (CSIRT), which is now coordinating an investigation alongside Microsoft. There’s no word yet on whether data was exfiltrated or corrupted.

Meanwhile, cybersecurity experts are urging institutions still running on-premise SharePoint servers to apply available patches immediately, reassess their infrastructure, and consider transitioning to more secure cloud environments.

What This Means for SA

As cybercrime becomes more globalised and sophisticated, South Africa is increasingly being caught in the crossfire. This latest incident isn’t just about a few infected servers. It’s about the urgent need for digital modernisation, proper risk assessments, and investment in cybersecurity talent, especially in the public sector.

If institutions as central as the Treasury can be breached, the question isn’t if another attack will happen, it’s when, and how prepared we’ll be next time.

{Source: Business Insider Africa}

Follow Joburg ETC on Facebook, Twitter , TikTok and Instagram

For more News in Johannesburg, visit joburgetc.com