SA: SARS Refutes Claims of eFiling Profile Hijacking, Awaits Ombud’s Final Report

The South African Revenue Service (SARS) has rejected reports alleging that over 16,000 taxpayer eFiling profiles were hijacked by cybercriminals, resulting in lost refunds. SARS, alongside the Office of the Tax Ombud (OTO), clarified that the claims were inaccurate and emphasized that the official position will be outlined in the Ombud’s final report, scheduled for release on October 1, 2025.

Concerns first emerged in June 2024, when taxpayers and industry stakeholders raised multiple complaints about compromised tax profiles. This prompted the Tax Ombud to seek approval from Finance Minister Enoch Godongwana to investigate SARS’s handling of the alleged breaches. Since then, SARS and the OTO confirmed they have been conducting an in-depth review of compromised accounts for more than a year.

Earlier this year, the OTO issued a public survey to taxpayers and tax practitioners to better assess the scale of the problem. While the findings were initially expected in July, SARS Commissioner Edward Kieswetter requested additional time to review preliminary outcomes, delaying publication to October.

Although dismissing the scale of the hijacking claims, SARS and the OTO acknowledged that the digitalization of tax services has created fresh opportunities for cybercriminals. Weak points such as login credentials and bank detail updates remain primary targets for fraudsters.

The issue forms part of a wider trend of cyberattacks against South African public institutions. In July, malware infiltrated the National Treasury’s IT systems, reportedly linked to a global Microsoft SharePoint vulnerability. Other government agencies — including the Companies and Intellectual Property Commission (CIPC), the State Security Agency (SSA), and the Government Employees Pension Fund (GEPF) — have also experienced breaches in the past two years.

In response to mounting risks, the Democratic Alliance (DA) has proposed establishing a National Cyber Commissionto coordinate cybersecurity defenses across government and private sector systems, enhancing resilience against sophisticated digital threats.

Commissioner Kieswetter reaffirmed SARS’s commitment to protecting taxpayer data, stressing that the agency will continue to invest in security measures to safeguard the integrity of its eFiling platform. He urged taxpayers to await the Ombud’s findings before drawing conclusions, assuring that SARS remains focused on strengthening trust and ensuring the safety of its online services.