A detailed document allegedly posted on social media before this week’s attack at a school in Umhlali has raised fresh questions about warning signs, intervention and the events leading to the stabbing of a six-year-old girl.
The 16-year-old boy accused of attacking the child appeared at the KwaDukuza Magistrate’s Court on Friday. The proceedings were held behind closed doors because of his age.
He was formally charged with attempted murder, housebreaking and trespassing. The matter was postponed to 30 October, and Legal Aid appointed an attorney to represent him.
The child was allegedly stabbed several times inside The Creative Classroom in Umhlali on Tuesday. She suffered serious injuries and required a three-hour operation after her lung and intestines were punctured. She remained in intensive care at the latest update.
The teenager was arrested after the attack. Investigators are now examining an alleged document titled “Mass shooting manifesto ig lol”, which former classmates obtained after the incident and believe was posted online approximately a week earlier.
The document allegedly described an intended attack, referred to a target and included images of homemade weapons. For safety reasons, the alleged document’s weapon-making instructions, security weaknesses and detailed attack plan are not reproduced here.
The contents have not been tested in court. Investigators must still establish who created the document, when it was posted, whether the accused wrote it and how closely it corresponded to the events at the school.
Child critically injured in classroom attack
The teenager allegedly entered a classroom at The Creative Classroom, a special-needs school behind Christ Church, and attacked the six-year-old girl with a long-bladed knife.
She sustained wounds to her chest, abdomen and arm. Medical personnel rushed her to hospital, where she underwent emergency surgery and was later treated in intensive care.
The accused was arrested at the scene. An image taken after the attack appeared to show him wearing a black T-shirt bearing the word “Wrath”. The shirt was said to resemble clothing associated with one of the perpetrators of the 1999 Columbine school shooting in the United States.
The clothing and alleged online material have drawn attention because of references to previous mass-casualty attacks. However, clothing, online interests or a written document cannot by themselves establish a criminal motive or prove that a person carried out an attack according to a particular ideology.
The criminal case remains before court, and the teenager is presumed innocent until the allegations are proven.
Alleged plan examined by investigators
Former classmates reportedly obtained screenshots of the alleged plan after contacting one of the teenager’s alleged confidantes on TikTok. They claimed that the document contained details that appeared to correspond with the attack, including the intended setting and the manner in which the teenager allegedly entered the property.
The document allegedly discussed feelings of isolation, revenge, online radicalisation and mental-health difficulties. It also referred to an earlier failed incident at Ballito Junction mall and alleged contact with an online acquaintance overseas.
The document reportedly contained language about wanting recognition and being remembered. It also referred to the teenager’s school history and alleged personal grievances.
The authenticity of the document, the identity of its author and the context of the statements will be important to the investigation. Social-media screenshots can be incomplete, altered or taken out of context, and investigators will need to secure the original data and verify when it was created and shared.
National Prosecuting Authority spokesperson Natasha Ramkissoon-Kara declined to comment on the document.
“The matter is under investigation, and we cannot comment at present.”
The NPA’s response means that authorities have not publicly confirmed the document’s authenticity or its evidentiary value.
Earlier Ballito Junction incident
The teenager had previously been linked to an alleged incident at Ballito Junction mall on 29 March, when an improvised explosive device was reportedly placed at the shopping centre.
The device failed to detonate and began emitting smoke, according to the available account. Charges connected to the incident were later withdrawn because of insufficient evidence.
Investigators are now examining whether the device was an actual explosive and what role, if any, the teenager played in placing it. The renewed inquiry is being conducted alongside the current attempted-murder case.
Dr Gérard Labuschagne, the former head of the SAPS Investigative Psychology Unit, previously assessed the teenager as a potential mass-violence risk after reviewing an earlier alleged manifesto.
Labuschagne warned that an arrest or police investigation would not necessarily remove the underlying risk if grievances, fixation or violent ideation remained unaddressed.
He has argued that intervention should include a competent violence-risk assessment, an examination of possible future scenarios and a plan to reduce the risk of further harm.
Other alleged warning signs
The alleged online plan refers to incidents that investigators may now examine as part of the teenager’s background.
He was allegedly involved in an incident at Ballito Junction on 4 March in which shoppers and security guards were reportedly sprayed with pepper spray. A recording allegedly connected to that incident has also circulated, but its authenticity and context have not been established in court.
The teenager was reportedly tackled and injured during the incident. He allegedly later posted material about it online.
During the December 2025 school holidays, he allegedly sent messages to a classmate saying that he hated everyone and intended to return to school to hurt people. The messages were reportedly shown to a principal, who removed him from the school and reported the matter to police.
The available information does not establish what action followed the report or whether an official risk assessment was conducted at the time.
The teenager later moved to a private homeschooling arrangement. Investigators will need to determine whether earlier reports were properly recorded, assessed and followed up, and whether they are relevant to the current case.
Security response and arrest
A private security officer, Chris Brussow of Alpha Security, reportedly apprehended the teenager as he tried to escape over a fence at the back of the property.
A private combat specialist, Rocky Schaper, also assisted after the attack and carried the injured child to an ambulance. Their accounts may form part of the investigation into how the teenager entered the school, what happened inside the classroom and how he was detained.
Police have not released the full sequence of events or confirmed whether the accused had a working firearm or another weapon besides the knife allegedly used in the stabbing. Any homemade weapon allegedly found at the scene will have to be examined by forensic and explosives experts.
Court case continues
The teenager appeared in court for the second time on Friday. Because he is 16, the proceedings were held in camera. His mother attended the hearing and was the only family member publicly seen supporting him at court.
He faces charges of attempted murder, housebreaking and trespassing. The case was postponed to 30 October.
The charges relate to the alleged attack at the school. Any charges arising from the Ballito Junction incident would depend on the outcome of the separate investigation into the device and the evidence available to prosecutors.
The NPA has not confirmed whether further charges will be added. Police and prosecutors have also not disclosed the teenager’s psychological assessment, if one has been completed.
The case has renewed debate about how schools, police, mental-health professionals and online platforms should respond when a young person allegedly expresses violent grievances or shows an interest in previous mass attacks.
For now, the six-year-old girl remains the focus of concern as she recovers from serious injuries, while investigators assess the alleged social-media document, earlier incidents and the circumstances of the attack. The teenager remains before court, and all allegations still have to be tested through the legal process.