A Water Utility Serving 16 Million People Loses Its IT Systems

Rand Water, which supplies more than 16 million people across Gauteng and parts of the Free State, North West and Mpumalanga, has confirmed a cyber security incident affecting certain information technology systems. IT staff detected unauthorised access attempts at night; some servers sustained damage. The utility has activated its disaster recovery site in Centurion, which is now serving as the primary operations centre while the main office systems are sanitised and replaced. Investigation continues with internal and external specialists.

The important sentence in the utility's statement is the one about what kept running: critical operational activities including water treatment processes, water quality control systems and bulk water supply operations remain fully operational. If that holds, it is the outcome every water utility's segmentation design is supposed to produce — corporate IT damaged, process control unaffected, and the two separated well enough that the incident did not cross.

That is worth stating plainly because the recent record has gone the other way often enough to make it newsworthy. A device manufacturer disclosed an incident last week in which the same class of intrusion stopped its ability to manufacture and ship. The difference between an event that becomes an operational crisis and one that becomes an IT recovery project is almost entirely a question of what could reach what.

Two things are worth watching before drawing conclusions. First, "fully operational" during the early days of an incident often means operating manually or in a degraded mode that is sustainable for days rather than weeks, and the strain shows up later in billing, scheduling, laboratory results and procurement rather than in supply. Second, the recovery is the harder half: rebuilding office systems from a disaster recovery site means re-establishing trust in identity infrastructure, which is where these events typically consume months rather than days.

For utilities elsewhere the practical question this raises is not about Rand Water's controls but about their own: if corporate IT went dark tonight, which operational functions would continue, which would degrade, and how long could the plant run on the answer. That is a tabletop exercise, and it is considerably cheaper than the alternative way of finding out.