The DA has urged President Cyril Ramaphosa to authorise a Special Investigating Unit probe into R2bn in billing fraud involving hackers and City officials in Ekurhuleni.

• The DA has urged President Cyril Ramaphosa to authorise a Special Investigating Unit probe into R2bn in billing fraud involving hackers and City officials in Ekurhuleni.
• Hackers allegedly exploited weak ICT security to erase debts, lower rates, and issue fake invoices, leading to a R2bn revenue shortfall.
• The DA links the fraud to systemic failures under Mayor Nkosindiphile Xhakaza and the murder of auditor Mpho Mafole, who was investigating the shortfall.

The DA wants President Cyril Ramaphosa to intervene in the City of Ekurhuleni’s billing woes, following reports that hackers colluded with City officials to siphon R2 billion.

DA Parliamentary leader George Michalakis has written to Ramaphosa to ask him to sign off on a Special Investigating Unit (SIU) proclamation.

This comes more than a week after Parliament’s Standing Committee on Public Accounts (Scopa) heard that hackers drove to the City of Ekurhuleni’s offices in Bedfordview, parked outside the building, connected to the municipality’s Wi-Fi, and hacked the virtual private network (VPN). Once they were in, they manipulated bills and cleared invoices, the committee was told. The heist played out over a year in 2024 and 2025, according to municipal officials.

Now, the DA wants Ramaphosa to refer the matter to the SIU.

READ | Scopa hears how hackers siphoned R2bn from Ekurhuleni municipality in cybercrime heist

In his 14 May letter, Michalakis asked Ramaphosa to consider issuing a presidential proclamation authorising the SIU to investigate the allegations.

“It is alleged that these cyber criminals, in collusion with City officials, erased electricity bill debts (either partially or in full) in return for payment by businesses and individuals to whom said debts accrue.

“It is reported that this practice has directly resulted in the City experiencing a revenue shortfall in excess of R2 billion. It is our understanding that such a shortfall will have a disastrous impact on the City’s ability to render municipal services to residents,” Michalakis wrote.

He added that it was also alleged that cyber criminals accessed the City’s electricity billing system due to officials’ failure to implement adequate Internet and Communication Technology (ICT) security practices.

Michalakis said they were aware that it allegedly included, but was not limited to:

“We understand from reports that the cyber criminals would allegedly manipulate certain debt amounts and invoices in return for payment.

“We understand that if City officials were involved in this practice and received ‘kickbacks’, as alleged, this constitutes corruption. City officials being complicit in the practice notwithstanding, we understand that the negligent act of allowing the ICT systems to become vulnerable to cybercrime and the failure to identify such vulnerability and the subsequent crime may, in any event, constitute a contravention of the Municipal Finance Management Act 56 of 2003,” he wrote.

In addition, Michalakis wrote that Mayor Nkosindiphile Xhakaza had linked the practice to the alleged murder of the City of Ekurhuleni’s group divisional head for corporate and forensic audit, Mpho Mafole, who was probing a revenue shortfall at the municipality.

“In light of the severity of the allegations as detailed above, we humbly request that you consider issuing a presidential proclamation authorising the Special Investigating Unit to conduct a full investigation into this matter,” Michalakis asked Ramaphosa.

READ | Rigour and persistence: How we investigated Mpho Mafole’s murder – and the mayor’s role

DA Ekurhuleni mayoral candidate Khathutshelo Rasilingwane said Michalakis’s letter followed an initial complaint to the SIU in July 2025, in which the party raised alarm over the disappearance of the funds and the apparent systemic failures that enabled it.

“The latest developments, including the Hawks' investigation, and reports emerging from Scopa, reinforce the urgency of decisive action.

“Any potential link [to Mafole’s murder] remains the subject of investigation and must be treated with the utmost seriousness.

“This matter goes beyond a technical breach. Under Mayor Xhakaza’s oversight, accountability within the City has collapsed, and weak controls have been allowed to persist, creating an environment in which public funds can be looted with little consequence,” Rasilingwane said.