Crypto-mining attack hits Lengau supercomputer as South Africa readies upgrade

Between May and June 2026, South Africa’s Centre for High Performance Computing (CHPC) located at the Council for Scientific and Industrial Research (CSIR) experienced a cyberattack targeting the Lengau high-performance computing system. Attackers gained unauthorized access to the supercomputer where they deployed cryptocurrency-mining malware.

Minister of Science, Technology and Innovation, Blade Nzimande, explained to members of Parliament last week that the breach was being investigated. The breach occurred because of vulnerabilities associated with the decade-old high-performance computing system. The minister reported that only certain components of the system were affected by the breach and not the wider national cyberinfrastructure environment.

“Due to the legacy environment, some components are ageing, technically constrained or no longer fully supported by original vendors,” said Nzimande. “Going forward, the existing escalation, reporting and cyber-risk oversight arrangements will be strengthened to ensure faster response and executive visibility of cybersecurity incidents affecting strategic research infrastructure.”

To shore up defenses, several measures have been introduced or reinforced to monitor the systems and detect abnormal workloads, suspicious authentication activity, and other indicators of compromise. The CSIR’s Defence and Security cluster’s cybersecurity specialists have been engaged to conduct forensic analysis and remediation.