Rand Water has disclosed a cybersecurity incident affecting some of its information technology systems but said its critical operational functions, including water treatment, water quality monitoring and bulk supply, remained fully operational.
Operational services unaffected, investigation under way
The bulk water utility, which provides potable water and sanitation services to Gauteng and neighbouring provinces, informed holders of its listed debt securities that it was responding to the incident with the assistance of internal and external specialists. The statement did not identify the nature of the attack, any suspected perpetrators, or whether customer or corporate data were compromised.
Rand Water emphasised that regular water quality monitoring and testing continued to ensure the ongoing delivery of safe drinking water in line with applicable standards. It also said treasury operations were running through a disaster recovery environment and that there was no indication of missing funds or impairment of its ability to service listed debt obligations.
"There is currently no indication of any missing funds or impairment of Rand Water’s ability to service its debt obligations or meet its obligations to noteholders arising from the incident," the statement read.
The disclosure was made in a notice to holders of its listed debt securities, reflecting the utility’s obligations under its listing on the Johannesburg Stock Exchange’s debt market.
Context: public-sector cyber risks
The announcement comes amid broader concerns over cyber vulnerabilities in South Africa’s public sector. The Auditor-General’s 2026 report previously highlighted weaknesses in government cyber defences and recalled a November 2024 ransomware attack that fully encrypted systems at the South African Bureau of Standards, disrupting business applications and delaying the submission of its 2024/25 financial statements.
Rand Water did not state whether the incident involved ransomware, and it has not named any attackers. The utility said it was investigating and managing the situation with specialists but provided no further technical detail in the notice to noteholders.
What the utility has confirmed
- Critical operations: water treatment, quality monitoring and bulk supply remain operational.
- Treasury: functioning through a disaster recovery environment; no indication of missing funds.
- Investigation: ongoing with internal and external specialists; nature and scope of the attack not disclosed.
The limited disclosure mirrors a pattern among listed public bodies, where regulatory obligations require timely notification to investors but do not always provide full technical detail to the public while forensic work continues.
| Function | Status (as reported) |
|---|---|
| Water treatment | Operational |
| Water quality monitoring | Operational |
| Bulk water supply | Operational |
| Treasury / debt servicing | Operating via disaster recovery |
For consumers and municipal customers, the immediate reassurance is that treatment and testing continued, reducing the likelihood of an abrupt service interruption. However, the lack of detail on the type of cyber incident and the systems affected leaves questions about potential longer-term IT restoration work, costs and the timeline for returning all systems to normal operations.
Nationally, the episode underlines the need for continued investment in cyber defences across state-owned entities and municipal service providers. The Auditor-General’s earlier warnings about vulnerabilities remain salient: when utility IT systems are compromised, the secondary effects can stretch from financial disclosure delays to operational risks for service delivery.
Rand Water’s note to debt holders is the latest public reminder that cybersecurity is a material risk for infrastructure operators. The utility said it will continue to engage specialists as the matter is investigated and managed, but offered no further operational or forensic detail at this stage.
