Eskom has ramped up efforts to secure its systems after uncovering a breach in its Online Vending System (OVS), which allowed the fraudulent generation and distribution of prepaid electricity tokens.
The breach, first disclosed in Eskom’s 2024 annual financial results, exposed significant weaknesses in both the physical and cybersecurity infrastructure underpinning its prepaid electricity operations. In response, the state-owned power utility has launched a sweeping review and implemented new security protocols aimed at restoring public trust and reinforcing system integrity.
We uncovered weaknesses in physical and cybersecurity components on our OVS system,” said Monde Bala, Group Executive for Distribution at Eskom.
“All system enhancements are managed through a robust Change Management process that spans all divisions,” added Len De Villiers, Chief Technology and Information Officer.
Key Interventions by Eskom:
- Implementation of stricter internal controls to combat electricity theft.
- Reinforcement of physical infrastructure and restrictions on access to both physical and digital systems.
- Enhanced monitoring and transparency tools for timely reporting.
- Ongoing collaboration with law enforcement, including the suspension of implicated employees.
- Engagement of an external IT firm to support in-house capabilities and risk management.
- Fast-tracked procurement of a new, secure vending system to replace the compromised OVS.
- Regular oversight and updates to the Eskom Board.
Eskom CEO Dan Marokane stressed that the interventions go beyond technical fixes.
“Our focus is on restoring trust and ensuring that customers can rely on a secure and efficient service. This is part of a broader commitment to transparency, operational excellence, and accountability.”
The investigation into the breach is ongoing, and details will be shared once the process concludes. Eskom is urging customers to stay alert and report any suspicious activity related to prepaid electricity.
