National Credit Regulator: Cyberattack Hinders Performance Verification Audit

• The National Credit Regulator's 2025 performance targets could not be fully verified by the Auditor-General due to a cyberattack.
• The cyberattack, which occurred in 2025, led to the loss of supporting performance information for the first two quarters.
• Auditor-General Tsakani Maluleke attributed the data loss to the cyberattack and management's failure to maintain secure off-site backup arrangements.
• Despite the performance verification issues, the NCR received an unqualified audit for its financial statements.
• Experts highlight that the incident underscores the public sector's cybersecurity vulnerabilities and the critical need for operational resilience and robust data recovery plans.

This critical data loss was attributed not only to the cyberattack itself but also to management's failure to establish and maintain secure, isolated, and effective off-site backup arrangements.

The National Credit Regulator (NCR) faced significant challenges in verifying its performance targets for 2025, as detailed in its recent annual report presented to parliament. While the South Africa credit regulator's financial records were found to be in order, allowing for an unqualified audit, the Auditor-General (AG) could not fully assess its operational achievements. This inability stemmed directly from a cyberattack that occurred in 2025, prior to the arrival of current CEO Otsile Maseng in 2026. Both internal auditors and the AG flagged the report for material misstatements due to the missing data.

Auditor-General Tsakani Maluleke NCR specifically highlighted that supporting performance information for the first two quarters of 2025 was unavailable. This critical data loss was attributed not only to the cyberattack itself but also to management's failure to establish and maintain secure, isolated, and effective off-site backup arrangements. Such arrangements are crucial for safeguarding vital information and ensuring its recoverability in the event of system disruptions. The AG concluded that "management did not implement and maintain adequate record-keeping to ensure that complete, relevant, accurate and readily accessible information was available to support performance reporting," pointing to "significant internal control deficiencies."

The National Credit Regulator audit report underscores a critical vulnerability within an entity responsible for overseeing South Africa's vast credit industry, which includes major banks, micro-lenders, and large retail firms. With consumer credit, encompassing current open loans, totaling R2.7 trillion as per the 2026 Q1 Eighty20/XDS Credit Stress Report, the NCR's role in maintaining market integrity is paramount. The incident reveals that even a key regulatory body can struggle with data integrity and operational resilience, impacting its ability to demonstrate its own effectiveness.

The AG's findings regarding the NCR data loss annual report serve as a stark reminder of the potential consequences when robust cybersecurity measures and data recovery protocols are not adequately implemented. The inability to verify performance targets due to lost data directly impacts accountability and transparency. This situation highlights the critical importance for all entities, especially those within the regulated financial sector, to ensure their own data management and cybersecurity frameworks are impervious to similar disruptions, allowing them to consistently meet compliance and reporting obligations.

The incident at the NCR reflects a growing trend of sophisticated cyberattacks targeting both businesses and government entities, a phenomenon partly exacerbated by the increasing accessibility of AI tools for malicious actors. Experts like RiXForensica director Riaan van Jaarsveld emphasize that the question for organizations is no longer if an attack will occur, but rather their preparedness to respond effectively. While preventing every intrusion may be impossible, strengthening defenses through measures such as multi-factor authentication, regular software updates, staff training on phishing detection, and maintaining secure data backups can significantly reduce vulnerability.

Ian Jansen van Rensburg, head of security engineering at Check Point Software, points out that the public sector in South Africa often contends with legacy systems and limited security resources, contributing to heightened risk. While a full forensic analysis would be necessary to determine the exact cause of the NCR's incident, the reported loss of information clearly illustrates that effective cybersecurity extends beyond initial intrusion prevention to encompass comprehensive operational resilience and the capacity for data recovery. Digital forensics expert Danny Myburgh notes that despite the South African government never paying ransoms, it remains a target, though he suggests its data may be less valuable than that held by the private sector.

This incident at the National Credit Regulator (NCR) highlights the critical importance for regulated entities (banks, lenders, retail firms) to ensure robust cybersecurity, data backup, and operational resilience. Lawyers and compliance officers should advise clients to review their own data integrity and recovery protocols, as a regulator's inability to verify its own performance due to data loss underscores the potential for similar vulnerabilities to impact a regulated entity's ability to demonstrate compliance or respond to regulatory inquiries.

Source: Original reporting on regulatory audit findings.