Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
South African Department of Justice ransomware attack, 2021
On the evening of 6 September 2021 ransomware encrypted the IT systems of South Africa's Department of Justice and Constitutional Development.
In short
On the evening of 6 September 2021 ransomware encrypted the IT systems of South Africa's Department of Justice and Constitutional Development. Email, the website, bail services and letters of authority stopped, and courts fell back on manual court recording. In 2023 the Information Regulator found that security licenses had expired in 2020, ordered fixes and fined the department R5 million.
What happened
The Department of Justice and Constitutional Development said its IT systems were interrupted by a security breach through ransomware on the evening of 6 September 2021. All information systems were encrypted and unavailable to staff and the public. Electronic services stopped, including letters of authority, bail services, email and the departmental website (gov.za, 20 September 2021).
The department activated its business continuity plan. Courts used manual recording equipment so sittings could go ahead, and the Office of the Chief Master used a manual process to give bereaved families the papers they needed for burials. Month-end child maintenance payments had already been processed. Some MojaPay functions came back and payments were made on 15 September 2021 (gov.za).
By 10 October 2021 the department said the spread of the malware had been contained and a number of online services were back. Most court recordings were intact, and parts of the Integrated Case Management System used by the Master of the High Court were accessible again. It also put a notice on its website for data subjects and said it had strengthened security (gov.za, 10 October 2021).
The Information Regulator later opened an own initiative assessment. On 9 May 2023 it issued an Enforcement Notice, and on 3 July 2023 it fined the department R5 million for not complying with it. In November 2025 the Minister said the department had taken the fine on review to the High Court.
See also the Transnet port systems ransomware attack of 2021, another South African ransomware incident.
Timeline
-
2020
The licenses for the department's security monitoring (SIEM), intrusion detection system and antivirus expire and are not renewed, according to the Information Regulator (9 May 2023).
-
6 September 2021
Ransomware encrypts the department's IT systems on the evening of this day.
-
September 2021
Letters of authority, bail services, email and the website stop. The business continuity plan is activated and courts use manual recording equipment.
-
15 September 2021
Some MojaPay functions are recovered and most child maintenance payments are made.
-
20 September 2021
gov.za lists two department statements: one on the security breach and one on progress in restoring services.
-
10 October 2021
The department says the spread of the malware has been contained, publishes a notice for data subjects and says it has strengthened security.
-
12 January 2022
The Deputy Minister says service at Master's Offices was worsened by the ransomware attack.
-
18 May 2022
The Minister tells Parliament the attack hit services and the modernization program.
-
8 February 2023
The Information Regulator tells a parliamentary committee it has had no conclusive report on the attack since 2021. The Director General says the Hawks have not given an update.
-
9 May 2023
The Information Regulator issues an Enforcement Notice to the department.
-
3 July 2023
The Regulator issues an Infringement Notice and a R5 million administrative fine for failure to comply.
-
11 November 2025
A Ministerial reply to Parliament says about 20% of Court Recording Technology records could not be recovered and the fine is under High Court review.
How the attack worked
The department’s own statements say little about the technical chain. They state that ransomware was used and that systems were encrypted. The department’s first statement describes in general how ransomware tends to spread, through phishing emails or drive-by downloads, but it does not say how this attack began. The most detailed account comes from the Information Regulator’s Enforcement Notice of 9 May 2023.
Safeguards that had lapsed
The Regulator found that the licenses for the department’s SIEM, its Intrusion Detection System and its antivirus had all expired in 2020 and were not renewed. The SIEM would have let the department watch for unusual network activity and keep backup copies of log files. The Intrusion Detection System would have alerted staff to suspicious access. Without the antivirus license, virus definitions for known malware were not updated. The Regulator says the department could not keep log backups because of limited storage, so critical information in the logs was not available.
The ransomware
The notice says an unknown threat actor installed the “Mespinoza Ransomware Virus” on the department’s systems, and that the department failed to put adequate access controls in place. Files were encrypted, which is Data Encrypted for Impact (T1486). The Regulator says the lack of monitoring meant the department could not detect data leaving its environment and records the loss of about 1,204 files.
What was and was not taken
Sources differ on data theft. The department’s first statement (September 2021) said no sign of data compromise had been detected. The Regulator (May 2023) recorded the loss of about 1,204 files. In November 2025 the Minister’s reply said investigations found no evidence that personal or security-related information was exfiltrated or unlawfully accessed.
- Safeguards lapseSecurity monitoring, intrusion detection and antivirus licenses expired in 2020 and were not renewed
- Unknown actor gains accessAn unknown threat actor got into the department’s systems; the sources do not say how
- Ransomware installedThe Mespinoza ransomware was installed on the department’s infrastructure
- Systems encryptedAll information systems were encrypted and unavailableTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- Services stopEmail, website, bail services and letters of authority went down; courts used manual recording
ATT&CK techniques
Who says who was behind it
No public attribution to a named group. The Information Regulator's Enforcement Notice (9 May 2023) says the Mespinoza ransomware was installed by an unknown threat actor.
The Minister's reply to Parliament (11 November 2025) says the attack was attributed to the Mespinoza ransomware variant deployed by an unknown threat actor, and that the perpetrators have not yet been identified.
On 8 February 2023 the Director General told a parliamentary committee that the Hawks had not yet provided an update on their investigation.
Impact
Department statement, 20 September 2021: all information systems were encrypted and unavailable to staff and the public. Letters of authority, bail services, email and the website were affected. Month-end child maintenance payments had been processed before the attack.
Information Regulator, 9 May 2023: about 1,204 files were lost because the department could not monitor and detect data leaving its environment.
Minister's reply, 11 November 2025: about 20% of Court Recording Technology records could not be recovered. Investigations found no evidence that personal or security-related information was exfiltrated or unlawfully accessed.
Minister, 18 May 2022: the attack affected existing technology-enabled services and the modernization program. Deputy Minister, 12 January 2022: it worsened service delivery at Master's Offices.
Regulator, 3 July 2023: administrative fine of R5 million. The sources opened give no figure for the cost of recovery.
Government and regulator response
- September 2021: The department activated its business continuity plan, used manual court recording and manual burial paperwork, and worked with industry partners and selected organs of state to contain and restore systems.
- 10 October 2021: It said the spread was contained, published a notice for data subjects on its website and said it had strengthened security measures.
- 8 February 2023: The Information Regulator told Parliament’s justice committee it had no conclusive report. The Director General said the department had answered every letter with the information it had and that ICT had been treated as a project reliant on consultants.
- 9 May 2023: The Regulator issued an Enforcement Notice. It ordered the department to renew the three licenses, report the compromise to the police, update its incident response plan, train staff on POPIA and start disciplinary proceedings against the officials responsible for the licenses.
- 3 July 2023: The Regulator fined the department R5 million after it sent no report and did not appeal.
- 11 November 2025: The Minister said the department had added endpoint protection, intrusion prevention, multi-factor authentication and stricter access controls, and had taken the fine on review to the High Court.
Lessons
-
Track license expiry for security tools
The Regulator found the SIEM, intrusion detection and antivirus licenses all expired in 2020 and were still unrenewed when ransomware hit in 2021.
-
Logs are only useful if kept
The department could not keep log backups because of storage limits, so key information was missing after the attack.
-
Have an incident response plan that includes notification
The Regulator found no updated plan covering POPIA section 22 and learned of the compromise only after it asked.
-
Plan manual fallbacks for critical public services
Manual court recording and manual burial paperwork kept courts and bereaved families served while systems were down.
-
Do not treat security as a project
The Director General said past leaders treated ICT as a project and relied on short-term consultants.
-
Backups need testing for every system
About 20% of Court Recording Technology records could not be recovered even though most systems were restored.
What to check in your own organization
-
License register
List every security tool license (monitoring, intrusion detection, antivirus, EDR) with its expiry date and an owner.
-
Log storage
Check that log storage is big enough to keep logs for months and that backups of logs exist off the main network.
-
Access control
Review who can reach file servers and remove broad access; add multi-factor authentication for remote and admin access.
-
Incident plan
Write down who reports to the regulator and to the people affected, and how fast, and test it in an exercise.
-
Manual fallback
For each critical service (courts, payments, bookings) agree a paper or offline procedure.
-
Backup restore test
Restore a sample of every critical system from backup, including special systems such as recording or case management.
-
Accountability
Name an official who answers for security license renewals and report expiries to senior management.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country South Africa South Africa has seen ransomware against national departments and state companies, and large leaks of personal data. Africa
Questions
When did the attack happen?
The department says ransomware struck on the evening of 6 September 2021.
Which services stopped?
All electronic services were affected, including letters of authority, bail services, email and the website.
Was data stolen?
Sources differ. The department first saw no sign of data compromise. The Information Regulator recorded the loss of about 1,204 files. A 2025 ministerial reply says investigations found no evidence of exfiltration.
Who was behind it?
No group is named. The Regulator and the Minister say the Mespinoza ransomware was deployed by an unknown threat actor, and the perpetrators have not been identified.
What penalty did the department face?
The Information Regulator issued an Enforcement Notice on 9 May 2023 and a R5 million fine on 3 July 2023. The department has taken the fine on review to the High Court.
Sources
- Justice and Constitutional Development establishes security breach on IT systems South African Government (gov.za)
- Justice and Constitutional Development updates on recent ransomware attack South African Government (gov.za)
- Justice and Constitutional Development update on progress in restoring justice services following Ransomware attack (10 October 2021) South African Government (gov.za)
- Enforcement Notice, Department of Justice and Constitutional Development (9 May 2023) Information Regulator of South Africa
- Media statement: Enforcement notice issued to the Department of Justice and Constitutional Development (10 May 2023) Information Regulator of South Africa
- Media statement: Infringement notice and R5 million administrative fine (4 July 2023) Information Regulator of South Africa
- Discussion with Justice Institutions on Matters of Mutual Interest (8 February 2023) Parliamentary Monitoring Group (Parliament committee record)
- Question NW5766 to the Minister of Justice and Constitutional Development, reply (11 November 2025) Parliamentary Monitoring Group (Parliament question and reply)
- Minister Ronald Lamola: Justice and Constitutional Development Dept Budget Vote 2022/23 (18 May 2022) South African Government (gov.za)
- Deputy Minister John Jeffery conducts oversight visit to Master's Office (12 January 2022) South African Government (gov.za)
- FLASH: Increase in PYSA Ransomware Targeting Education Institutions (16 March 2021; PYSA is also known as Mespinoza) FBI, coordinated with CISA (IC3)
- Data Encrypted for Impact, Technique T1486 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.