Serious Security Flaws in SASSA System Exposed Again

Serious Security Flaws in SASSA System Exposed Again. An investigation into the Social Relief of Distress (SRD) grant system of the South African Social Security Agency (SASSA) has once again revealed serious security vulnerabilities, leaving the platform exposed to cyber threats and fraud. This marks the second time that the same investigation team has presented similar findings to Parliament, raising concerns about the effectiveness of the inquiry and its cost to taxpayers.

Serious Security Flaws in SASSA System Exposed Again

The investigation, conducted by Masegare & Associates Incorporated, uncovered significant flaws in SASSA’s online payment system, making it a target for cybercriminals. Fraudulent websites impersonating SASSA’s official platform are actively stealing applicants’ data, resulting in identity theft and financial fraud. These revelations were presented to the Parliament’s Social Development Portfolio Committee, prompting Social Development Minister Nokuzola Tolashe to promise stricter oversight and accountability.

Key security concerns highlighted in the investigation include:

• Weak authentication policies allow hackers easier access to the system.
• Unprotected backup files increase the risk of sensitive data leaks.
• Missing security headers exposing user information to potential breaches.
• Server misconfigurations enabling unauthorized access to internal data.

While the system was classified as a “medium” threat level, many experts argue that the risks are more severe. Fraudsters have exploited these weaknesses to submit large numbers of fraudulent SRD applications using ID numbers of individuals who had just turned 18.

Government’s Response and Rising Concerns

Despite repeated warnings, SASSA’s security vulnerabilities remain unresolved. The investigation, which cost taxpayers approximately R280,000, failed to fully assess the extent of fraud, the number of affected victims, and the financial losses incurred due to wrongful payouts.

Acting SASSA CEO Themba Matlou acknowledged these weaknesses but reassured MPs that measures were being taken to improve security. “We’ve put in place risk mitigation processes and implemented security updates. The system has been reconfigured, but there’s still work to be done,” Matlou said.

However, MPs expressed dissatisfaction with the response, questioning the lack of deadlines for fixing these security flaws. Paulnita Marais (EFF) also raised concerns about how beneficiaries without smartphones could complete identity verification, further complicating the process.

Recommendations to Strengthen SASSA’s Cybersecurity

To mitigate future risks, the investigation suggested several key measures:

• Implement multi-factor authentication (MFA) to enhance security and prevent unauthorized access.
• Stricter controls on grant applications, linking each applicant’s ID to a unique phone number to avoid multiple fraudulent registrations.
• Regular security audits to identify vulnerabilities and prevent breaches.
• Expanding biometric verification to detect fraudulent applications more effectively.
• Shutting down fraudulent websites by collaborating with domain registrars and cybersecurity teams.

Conclusion

Despite repeated warnings, SASSA’s failure to address its cybersecurity issues remains a significant concern. With fraudulent applications continuing to exploit system weaknesses and fake websites preying on vulnerable applicants, urgent action is needed. Minister Tolashe emphasized the government’s commitment to accountability, stating, “We have no excuse. Not now, not tomorrow. Our people have gone through enough due to a lack of strategic leadership.”