South Africa's National Credit Regulator has an unqualified audit for its finances, but the Auditor-General could not confirm whether it actually hit its performance targets for the first half of the year. A cyberattack is part of the reason, and the missing backups are the rest.

What happened

Auditor-General Tsakani Maluleke recorded that supporting performance information for several indicators in Quarter 1 and Quarter 2 was unavailable. She attributed this to two causes: the cyberattack itself, and management's failure to establish and maintain secure, isolated and effective off-site backup arrangements to safeguard critical information and ensure recoverability after a system disruption. Internal auditors raised the same gap, and the AG described the loss of data as flowing from significant internal control deficiencies.

The specific indicators that could not be assessed were the number of investigations into credit providers under the National Credit Act, enforcement actions as a percentage of those investigations, investigations into debt counsellors, and enforcement actions against non-compliant debt counsellors. The attack happened in 2025, before current CEO Otsile Maseng took over. He told Moneyweb that systems and backup were in place at the time, but the incident showed the need to strengthen digital infrastructure, information security and business continuity.

Who is affected

• The National Credit Regulator itself, with an audit finding now on the public record
• The credit providers, debt counsellors and lenders it supervises, in an industry holding roughly R2.7 trillion in open consumer credit
• Any South African organisation that assumes a backup exists because a backup system was bought

What to do now

Test a restore from an isolated, off-site copy this month, and record the result. A backup that sits on the same domain, the same credentials or the same network as production is not the control the AG was looking for, and it is not the control POPIA expects.

• Confirm at least one copy is offline or immutable, and that the backup system does not authenticate with production domain credentials
• Restore a real business system into a clean environment and time it, rather than reading a success status from the backup console
• Keep the evidence: what was restored, when, by whom, and how long it took
• Write the restore test into the business continuity plan, because auditors now ask for it by name

What this means for South African businesses

This is the finding that matters more than the breach, because it is about recovery rather than prevention. A regulator with a security budget and an audit committee still ended up unable to prove what it did for two quarters, and the Information Regulator is already handling thousands of compromise reports a year. In my experience the failure mode is common in South African mid-market environments: backups exist, run nightly, report green, and have never been restored by anyone who owns the business risk.

Source: Moneyweb, reporting the National Credit Regulator's annual report and the Auditor-General's findings.

Also on the blog

• Ivanti Connect Secure CVE-2026-111357: privilege escalation to root, exploited since 1 October
• TeamViewer CVE-2026-111585: a malicious host can run code on the technician's PC

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.