A shadowy network of hackers, spies, and corrupt insiders has pulled off one of the biggest digital robberies in South African history. Investigators have revealed how a cyber-crime syndicate effectively seized control of the City of Ekurhuleni’s IT systems, siphoning off a staggering R2 billion through a sophisticated "inside job."
A forensic report by OMA Chartered Accountants, completed in July 2025, has pulled back the curtain on a nightmare scenario where the city's billing infrastructure was turned into a personal ATM for criminals.
The Spy in the Server Room
The investigation uncovered a plot that reads like a spy movie. It wasn't just a remote hack; it involved a physical infiltration of municipal offices. Lucas Mhlonishwa Dhlamini, a former security consultant, was caught connecting a "spy laptop" directly to the city's servers at the Kempton Park Customer Care Centre.
This laptop was loaded with malicious software, including "keyloggers" that recorded every single button pressed by municipal staff. This allowed the syndicate to harvest usernames and passwords for high-level administrator accounts. Even the laptop of the former municipal manager, Imogen Mashazi, was hacked.
Every time IT staff found and removed the spyware, the criminals simply reinstalled it. It was a constant battle that the city was losing.
Deleting Debt for Cash
Once the syndicate had control of the "SOLAR" billing system, they began a systematic operation to delete municipal debt. The scheme was simple but deadly effective:
• Corrupt insiders and property lawyers (conveyancers) would identify properties with huge municipal debts.
• Payments of about R40,000 per transaction were funneled to "billing solution providers"—which were actually front companies for the syndicate.
• In exchange, the syndicate would log into the system and manually delete or alter the debt records.
• This created a "clean" record, allowing properties to be sold and transferred even though they owed millions to the city.
In one shocking example, a property in Etwatwa was cleared for transfer despite having massive outstanding debt, all because a Springs-based firm allegedly paid R40,000 to the "solution providers."
A Total Collapse of Security
The OMA report is scathing about the state of Ekurhuleni's IT security. It describes a "near total collapse" of controls that left the city wide open to abuse.
• No Audit Trails: The billing system had no reliable way to track who made changes. Criminals could delete records and erase their tracks without anyone knowing.
• Shared Accounts: More than 60 high-level "administrator" accounts were being shared among multiple people, making it impossible to hold anyone accountable.
• No Segregation of Duties: The same users could create, approve, and change billing transactions. It was like giving the same person the keys to the bank and the code to the vault.
The city’s chief information officer, Peter Paulos Moloko Monyepao, has been suspended while the Hawks investigate how the ICT environment was allowed to fall apart so completely.
The Deadly Cost of Truth
The investigation has taken an even darker turn following the murder of Mpho Mafole in 2025. Mafole was the head of corporate and forensic audits for the city and was reportedly leading several sensitive investigations—including the probe into this R2 billion billing fraud—at the time of his death.
His killing has raised fears that the syndicate is willing to use extreme violence to protect its "shadowy operation."
Questions for the IT Giants
The forensic report also points a finger at Business Connexion Group (BCX), the city's long-time IT service provider. BCX had deep access to the billing systems but investigators found "minimal oversight" and no proper records of who was doing what.
While the report doesn't accuse BCX staff of being part of the fraud, it slams the company for the failures that happened under its watch. BCX has acknowledged the reports but claims it was not responsible for the security breaches beyond its specific contract.
As the Hawks continue their investigation, the people of Ekurhuleni are left to wonder how their money could be stolen so easily. The R2 billion loss is not just a number on a screen; it represents money that should have gone to fixing roads, providing water, and building homes.
Instead, it has vanished into the pockets of a "cyber-crime syndicate" that knew exactly where to strike.
