Cyber Incident Victim: Department of Water Affairs
Date:
Feb 2016
Location:
South Africa
Summary
A subdivision of the Anonymous hacktivist collective breached South Africa's Department of Water Affairs as part of broader campaigns targeting social issues and government corruption in Africa. The attackers compromised the department's website database, exfiltrating and publicly leaking sensitive personal information of over 5,800 employees and collaborators, including names, email addresses, ID numbers, and—for some individuals—additional details like phone numbers, birth dates, and job titles. Hackers also gained administrative access to the site's backend systems, enabling potential manipulation of user accounts, government project data, and critical infrastructure information such as water quality measurements from supply stations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On February 15, 2016, members of the World Hacker Team—a subdivision of the hacktivist collective Anonymous—breached the website of South Africa's Department of Water Affairs (DWA). This attack formed part of Anonymous' broader #OpAfrica and #OpMonsanto campaigns, which aimed to expose child labor exploitation and government corruption across African nations. The group had previously targeted Rwanda, Uganda, and South African entities, including a mass defacement of 2,532 websites hosted by Webafrica shortly before the DWA incident. Attackers infiltrated the DWA website’s database, exfiltrating and publicly leaking sensitive records belonging to over 5,800 government employees and collaborators. The compromised data included full names, email addresses, and national identification numbers for all affected individuals, with additional details such as phone numbers, birth dates, physical addresses, departmental affiliations, job titles, and hashed passwords exposed for a subset of victims.
Beyond data theft, the hackers gained administrative access to the website’s backend control panel. This unauthorized access enabled them to modify user accounts, alter site content, and retrieve sensitive government project documentation. Attackers also extracted statistical and historical water quality measurements from multiple supply stations monitored by the department. The breach exposed operational and personnel vulnerabilities within a critical infrastructure agency, compromising both employee privacy and institutional data integrity. No details regarding the department’s detection methods, containment efforts, or post-incident responses were disclosed in available reporting. The incident underscored the targeting of governmental entities by ideologically motivated actors during Anonymous’ sustained #OpAfrica initiative.