South African Department of Employment and Labour

Summary

A South African government department experienced an attempted distributed denial of service (DDoS) attack targeting a public-facing server hosted by an external Domain Name Server (DNS) at the State Information Technology Agency. The department confirmed no internal systems, servers, or client information were compromised due to protective separation measures. Its IT unit collaborated with the hosting agency and security experts to investigate the incident, maintaining that public and client data remained secure throughout the event.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In early September 2018, the South African Department of Labour reported an attempted cyberattack targeting its digital infrastructure over a weekend preceding September 3. The incident involved a distributed denial of service (DDoS) attack directed at one of the department’s public-facing servers, specifically an external Domain Name Server (DNS) hosted by the State Information Technology Agency (SITA). Acting Chief Information Officer Xola Monakali confirmed the attack aimed to disrupt services but emphasized that no internal departmental servers, systems, or client information were accessed or compromised. The department’s IT unit identified the attack vector and confirmed the separation of critical internal systems from the targeted public-facing infrastructure, which contained protective measures to isolate sensitive data. Following detection, the department collaborated with SITA and external cybersecurity experts to investigate the incident’s origin and scope. Public assurances were issued stating that client data remained secure throughout the event, with no evidence of data exfiltration or unauthorized access to protected networks.

The attack’s impact was confined to the DNS server’s availability, with no operational disruption reported to internal departmental functions or data repositories. Monakali clarified that the segregation between public-facing and internal systems prevented escalation beyond the initial target. No ransomware deployment, data breaches, or system compromises were identified during or after the attack. The department maintained continuity of its services and client operations without interruption. Post-incident, the investigation focused on analyzing attack patterns and reinforcing existing security protocols in coordination with SITA. No attribution to specific threat actors or motives was disclosed publicly. The department reiterated its commitment to infrastructure security but did not disclose specific technical mitigations implemented beyond the collaborative investigation. Client and public trust preservation remained a stated priority in all communications following the incident.

Sources

Sources available to members: 1 source.