Rand Water, which supplies potable bulk water and sanitation services to South Africa’s Gauteng and neighbouring provinces, said its critical operations, including water treatment, water quality monitoring and bulk water supply, remained fully operational.
“Rand Water wishes to advise noteholders that it is currently responding to a cybersecurity incident affecting certain information technology systems,” the utility said in a statement.
The incident was being investigated and managed with the support of internal and external specialists, it said, without providing details on the nature of the attack, the suspected perpetrators or whether any data had been compromised.
Rand Water said regular water quality monitoring and testing remained in place to ensure the continued delivery of safe drinking water in line with applicable standards.
Its treasury operations were continuing through a disaster recovery environment, while the utility remained able to meet its obligations under its listed debt securities, it said.
“There is currently no indication of any missing funds or impairment of Rand Water’s ability to service its debt obligations or meet its obligations to noteholders arising from the incident,” the statement read.
The disclosure comes amid growing concerns over cybersecurity vulnerabilities across South Africa’s public sector.
The Auditor-General has previously warned of weaknesses in government cyber defences. Its 2026 report highlighted the South African Bureau of Standards, whose systems were fully encrypted in a November 2024 ransomware attack, disrupting business applications and preventing it from submitting its 2024/25 financial statements.
Rand Water disclosed the incident in a notice to holders of its listed debt securities, reflecting disclosure requirements associated with its listing on the Johannesburg Stock Exchange’s debt market.
The utility did not say whether the incident was linked to ransomware or identify any suspected attackers.
This version keeps the cyberattack as the lead, gives the operational reassurance early, and moves the broader South African cyber-risk context to the end, which is closer to a Reuters news hierarchy.
