The charges against Erasmus relate to a 2023 incident in which he and co-accused Felix Unathi Pupu (43), both former employees of Ecentric, installed software on the company’s systems that enabled unauthorized remote access. This access was later exploited in an attempted ransomware scheme that included multiple extortion attempts and led to significant data breaches.

Erasmus was convicted on a wide range of charges, including:

• One count of contravening section 12 of the Cybercrimes Act No. 19 of 2020

• One count of theft of data

• Two counts of attempted cyber extortion

• Four counts of cyber fraud

• Four counts of unlawful access to a computer system

• Three counts involving unlawful use of software or hardware tools

• Two counts of unlawful interference with network or data

• One count of interference with a data storage medium

• One count of password resetting

• One count of unlawful access

• One count of trespassing

According to court documents, the software installed by the accused allowed a third party to breach Ecentric’s IT infrastructure. On 14 November 2023, a ransom demand was made to Ecentric’s CEO, requesting payment of US$534,260 within 16 hours, with the threat that company data would be leaked publicly—including to competitors and regulators—within 30 hours. When the initial demand was not met, a second ransom of US$1 million was issued on 30 November 2023.

Ecentric did not comply with either demand. However, four of its retail clients sustained financial losses totalling R794,808.51 as a result of the cyberattack.

Erasmus has been in custody since 14 December 2023. His co-accused, Felix Pupu, remains in custody and is scheduled to appear in court on 30 June 2025 for plea and sentencing.

As part of the conditions tied to the suspended portion of his sentence, Erasmus must not commit any further offences relating to fraud, cybercrime, or trespassing during the five-year suspension period. A violation would lead to the activation of the suspended sentence.

The court also declared Erasmus unfit to possess a firearm.

This case marks a significant application of South Africa’s Cybercrimes Act and highlights the growing focus on criminal accountability for cybersecurity breaches involving insider threats.

Ecentric welcomed the court’s decision, confirming Erasmus’s conviction and sentencing. Digital forensics firm Cyanre, which assisted in the investigation, praised the outcome, calling it a milestone in South Africa’s fight against cybercrime. The company lauded the collaboration between law enforcement and legal experts, highlighting the success as a testament to the Cyber Crimes Act’s effectiveness.

The post Landmark cybercrime conviction: Former IT employee sentenced to eight years for fraud and extortion plot appeared first on ProtectionWeb.

·             the unlawful interception of data;

·             the theft of incorporeal property;

·             cyber fraud;

·             cyber forgery and uttering;

·             cyber extortion;

·             the unlawful acquisition, possession, provision, receipt or use of a password,       access code or similar data or device;

·             unlawfully accessing a computer system or computer data storage medium; and

·             the unlawful interference with data, a computer programme, a computer data storage medium or a computer system.

The Cybercrimes Act also places certain obligations on institutions and corporations to comply with stringent security requirements in managing the data of citizens and employees. Contravention of the Cybercrimes Act may, upon conviction, result in several penalties, including fines and up to 15 years imprisonment.

Various key sections of the Cybercrimes Act took effect on 1 December 2021. Businesses are increasingly relying on the Cybercrimes Act to enforce their rights to their proprietary information and data.

Recently, a South African airline exercised its rights under the Cybercrimes Act against a former employee accused of engaging in industrial espionage and misappropriation of the airline’s incorporeal property. The airline filed a complaint in terms of the Cybercrimes Act with the South African Police Service. The airline alleged that the former employee disclosed its confidential information obtained during the employee’s tenure with the airline, to the employee’s new employer without authorisation.

Among other things, the employee was accused of unlawfully disseminating copies of documents containing client revenues, thereby violating the confidentiality and proprietary interests of their former employer.

Businesses should not only have regard to the protections and possible remedies the Cybercrimes Act offers them, but also to their own obligations under the statute.

Importantly, electronic communications service providers and financial institutions have specific duties in relation to reporting cybercrimes (although these obligations have been suspended until a date to be determined by the President). In terms of section 54, electronic communications service providers and financial institutions must report any cybercrime involving their electronic communications service or network to the Information Regulator and the South African Police Service within 72 hours of becoming aware of the offence. Any information which may be of assistance to the South African Police Service in conducting their investigation must also be preserved. A failure to comply with these obligations may upon conviction attract a fine of up to R50 000.

According to a directive published by the South African Reserve Bank (SARB), effective August 2024, participants in the National Payment System also have certain duties in relation to reporting cybercrimes. The directive introduces new cyber-security requirements for payment institutions regulated under the National Payment System Act 78 of 1998, including clearing system participants, settlement system participants, third-party payment providers, system operators, payment clearing house system operators, and the operators of payment system financial market infrastructures.

Notably, payment institutions and operators must report material cyber-incidents to the SARB within 24 hours of the cyber-incident occurring and must submit a report to the SARB containing specified information regarding the cyber-incident within 48 hours of the cyber-incident occurring. Payment institutions and operators are also required to provide ongoing updates to the SARB until the incident is fully resolved. As part of their internal business processes, payment institutions and operators must also ensure that any information-sharing arrangements they enter into comply with the relevant provisions of the Cybercrimes Act relating to the disclosure of information.

Other legislation, such as the Financial Intelligence Centre Act 38 of 2001 and the Prevention and Combatting of Corrupt Activities Act 12 of 2004, also imposes mandatory reporting obligations and it is vital that businesses are aware of their obligations to notify authorities of certain events and offences.

The post Understanding your rights and obligations under the Cybercrimes Act: An integral aspect of businesses’ data and information protection processes appeared first on ProtectionWeb.