Crisis at a South African state-owned entity that lost R69 million in one year

The South African Bureau of Standards (SABS) is experiencing a financial and operational crisis stemming from a cyberattack two years ago.

SABS is South Africa’s national standardisation body and a statutory entity operating under the oversight of the Department of Trade, Industry and Competition.

The entity was formed on 1 September 1945 under the Standards Act, and continues to promote and maintain South Africa’s National Standards (SANS) across various sectors.

SABS recently presented its 2024/25 annual report to the Portfolio Committee on Trade, Industry and Competition in Parliament.

None of the Bureau’s board members was present at the meeting, and the ministerial team and director-general later apologised to the cabinet committee for this.

Acting CEO Blake Mosley-Lefatola was reportedly off sick, leaving Head of Compliance Risk & Legal Services, Joseph Leotlela, to lead the SABS delegation.

Portfolio Committee Member Toby Chance said the results presented by SABS for its 2024/25 financial year were not a pretty sight.

“A ransomware cyberattack in November 2024 crippled its systems so badly it had to rebuild them from scratch,” Chance said.

“The loss of data meant the annual report was published a year late, while the Auditor-General has yet to review the 2025/26 results.”

As a result of the cyberattack, SABS reported an operating loss of R69.5 million for the 2024/25 financial year, with expenditure up 14.1% while income grew by 2.8%.

Net interest of R51.6 million cushioned the bottom line, but irregular expenditure at SABS rose to R52.2 million that year.

The Bureau achieved 10 of its 18 KPIs (56%), with an operating margin of -4.8% and an operating cash ratio of -6.9%.

It published 284 standards against a target of 360, the lowest since 2020, while deficiencies in governance, oversight, and internal controls contributed to compliance failures.

SABS slammed by Parliament

Members of the Portfolio Committee criticised the leadership of SABS for failing to appear during the committee meeting, with Chance describing it as “extraordinary”.

They also questioned whether using the cyberattack to explain its poor financial performance was a cover for broader management shortcomings.

SABS has received an unqualified audit opinion with findings from the Auditor-General of South Africa (AGSA) every year since 2019/20.

Despite this, Chance said that zero-consequence management had not been implemented against responsible executives or employees until the intervention of Trade Minister Parks Tau.

Tau appointed private contractor TSU Protective Services in February 2025 to conduct a forensic investigation into the ransomware attack.

TSU’s report, presented to the Portfolio Committee in redacted form in May 2026, called for disciplinary action against certain executives, amongst other operational interventions.

These executives were found to have failed to implement cybersecurity recommendations issued by the AGSA and the State Security Agency in 2022.

“The failure to appear before the committee meant there was no opportunity to get an update on measures to implement the report’s recommendations,” Chance said.

“We also could not get answers relating to the request for proposal issued by the SABS for a review of its business model or how it plans to fund the refurbishment of its laboratories.”

This refurbishment is estimated to cost R1.6 billion, and will include the replacement of critical testing equipment and the modernisation of facilities dating back to the 1970s.

The Portfolio Committee agreed to conduct an oversight visit to the SABS headquarters in Pretoria, with the ministerial team, board members, and key executives present.

“The SABS is at the heart of South Africa’s quality system and the SABS mark used to be a trusted signifier of quality for South African manufactured products,” Chance said.

“Its decline has to be reversed as part of the GNU’s commitment to appoint fit-for-purpose individuals on merit, rather than the rag-tag collection of misfits who have run this treasured institution into the ground.”