Cyber Incident Victim: South African Department of Employment and Labour

In early September 2018, the South African Department of Labour reported an attempted cyberattack targeting its digital infrastructure over a weekend preceding September 3. The incident involved a distributed denial of service (DDoS) attack directed at one of the department’s public-facing servers, specifically an external Domain Name Server (DNS) hosted by the State Information Technology Agency (SITA). Acting Chief Information Officer Xola Monakali confirmed the attack aimed to disrupt services but emphasized that no internal departmental servers, systems, or client information were accessed or compromised. The department’s IT unit identified the attack vector and confirmed the separation of critical internal systems from the targeted public-facing infrastructure, which contained protective measures to isolate sensitive data. Following detection, the department collaborated with SITA and external cybersecurity experts to investigate the incident’s origin and scope. Public assurances were issued stating that client data remained secure throughout the event, with no evidence of data exfiltration or unauthorized access to protected networks.

The attack’s impact was confined to the DNS server’s availability, with no operational disruption reported to internal departmental functions or data repositories. Monakali clarified that the segregation between public-facing and internal systems prevented escalation beyond the initial target. No ransomware deployment, data breaches, or system compromises were identified during or after the attack. The department maintained continuity of its services and client operations without interruption. Post-incident, the investigation focused on analyzing attack patterns and reinforcing existing security protocols in coordination with SITA. No attribution to specific threat actors or motives was disclosed publicly. The department reiterated its commitment to infrastructure security but did not disclose specific technical mitigations implemented beyond the collaborative investigation. Client and public trust preservation remained a stated priority in all communications following the incident.