Legal Aid SA resets all passwords after phishing attack

This, amid internal documents referring to a recent cyber attack, even though the organisation says it is unaware of any successful breach of its IT systems or information.

Legal Aid SA, which is currently embroiled in a strike over salaries, workloads, career progression, staffing and labour relations, provides free legal representation to South Africans who cannot afford private attorneys.

Phishing e-mails, which circulated around 8 and 9 October, purport to be final demands or summonses from the National Prosecuting Authority. Employees who opened an attached PDF were prompted to enter their login credentials, although it is not known whether anyone supplied them.

Internal documents seen by ITWeb show Legal Aid SA instructed employees to attend compulsory cyber security training.

The document states: “Due to a recent cyber attack in the organisation, all employees are required to attend a mandatory cyber security webinar. Attendance will be monitored to ensure full compliance.”

The Information Regulator says it has not received a notification of a security compromise. It notes that Legal Aid SA would be required to report a breach “as soon as reasonably possible where there are reasonable grounds to believe the personal information of a data subject has been accessed or acquired by an unauthorised person”.

The notice offers employees two training dates, 13 and 27 October, covering modern cyber threats, artificial intelligence risks, phishing, deepfakes, data privacy and everyday cyber security practices.

In a separate communication, headed “Mandatory Password Change for All Users”, Legal Aid SA’s information systems department linked the password resets to the phishing incident.

“Following the recent phishing incident, we will be implementing a mandatory password change for all users as part of our efforts to strengthen IT security,” it states. “All users will be prompted to change their passwords upon their next logon.”

Legal Aid has implemented a mandatory password change. (Source: Internal documentation) The communication adds that “restrictions on implemented e-mail usage will be adjusted,” although it does not explain what restrictions have been introduced, or how they will be changed.

ITWeb could find no public claim of responsibility for the phishing attack, and the identity of those behind it remains unknown.

Legal Aid SA spokesperson Pateka Quwe says the organisation is “not aware of any cyber security breach or successful cyber attack that has compromised the organisation’s IT systems or information”.

Quwe says Legal Aid SA, like many organisations, is continually exposed to cyber security threats, including phishing attempts and malicious e-mail activity. “These are common cyber security risks that IT departments routinely monitor and mitigate as part of their ongoing security operations.”

Cyber security company Kaspersky reports blocking 5.7 million online attacks in South Africa during the first half of 2026, with 17.2% of its users in the country encountering web-based threats.

Kaspersky finds that almost a quarter of hacks involve social engineering. (Source: Kaspersky) In separate research published in August, Kaspersky finds that 78% of South African small and medium businesses experienced cyber security incidents over the preceding year.

Social engineering was the most commonly reported incident category, affecting 23% of businesses surveyed. Phishing, weak or stolen credentials and business e-mail compromise each affected 18%, followed by software vulnerability exploitation at 15%.

The research also identifies a lack of cyber security awareness among employees as a significant risk factor, cited by 28% of South African respondents.

Quwe says the organisation has established cyber security controls to detect and respond to potential threats, and regularly reviews and implements preventative measures, including password security controls, enhanced e-mail security and employee awareness initiatives.

“Mandatory cyber security awareness training is conducted monthly to reinforce employees’ understanding of cyber security risks and promote secure digital practices,” says Quwe. She adds that Legal Aid SA enforces password resets where necessary as a precautionary measure to mitigate potential risks.

According to Quwe, these measures form part of the organisation’s continuous cyber security risk management framework and its commitment to safeguarding its IT infrastructure.

Separately, Legal Aid SA advertised a tender on 18 September for the provision of a next-generation wide area network, secure internet connectivity, managed security services and disaster recovery services. The tender closed on 19 October, following the phishing incident earlier in the month.