City Power allays fear that hackers may cut your power

The expansion of City Power’s digital capabilities came with inherent cybersecurity risks.

No digital security breaches have been reported since a ransomware attack disrupted the entity’s IT systems in 2019; however, it has been complacent.

City Power’s battle with infrastructure thieves has predominantly been physical, but it has ensured that its online systems are safe and secure.

Hybrid cybersecurity model

The 2019 attack crippled prepaid electricity customers and stifled the entity’s ability to respond to outages.

City Power stated that the attack forced it to implement a multi-layered approach, which featured a dedicated internal team and a specialised external firm for real-time monitoring and threat intelligence.

“This hybrid model ensures a dynamic, proactive defence posture capable of responding to an increasingly complex cyber threat landscape,” City Power spokesperson Isaac Mangena told The Citizen.

Eskom suffered a security breach of its internal token vending platform in 2022 that led to the generation of unauthorised tokens.

Eskom was approached by The Citizen on 21 May, requesting an update on information about its cybersecurity efforts; however, no response had been received at the time of publication.

Almost 90% of companies reported attacks

City Power and Eskom are not alone in their vulnerability to cyber threats, as a Council for Scientific and Industrial Research (CSIR) study highlighted the widespread nature of attacks.

CSIR’s report from October showed that 47% of South African organisations reported between one and five cybersecurity incidents in the 2023/24 financial year.

The survey found that 88% of companies had suffered at least one cyber breach, with 90% of companies having been targeted more than once.

 The CSIR advocated for greater investment in cybersecurity, improved digital identity and the fostering of public-private partnerships.

“Cybersecurity must therefore be prioritised as a strategic imperative across all aspects of governance and service delivery,” stated Cybersecurity Hub’s Dr Kiru Pillay in the report.

Meters and vendors

Smart meter and electricity token vendors are external access points that can be exploited to disrupt operations.

City Power said interfacing systems and token distribution infrastructure were subject to strict cybersecurity requirements in line with domestic and international standards.

“Contractual obligations enforce regular audits, data protection policies, and incident response capabilities,” said Mangena.

“These requirements are non-negotiable and are designed to ensure the integrity of our systems and the safety of customer information.

 “Despite this, it’s important to note that while these measures significantly reduce the risk of compromise, no digital system can be deemed entirely immune from exploitation,” he added.

R15 million annually on security

To cover the cost of securing the electricity network’s digital infrastructure, City Power is allocated roughly R15 million a year for cybersecurity.

Recent upgrades include end-to-end encryption of all data communications, regular updates to firmware and next-generation smart meters.

“While no system is completely immune to attacks, our investment in both human expertise and technological safeguards places us in a strong position to detect, respond to, and mitigate potential meter tampering,” said Mangena.

The cybersecurity budget also covers training, research and development of new technologies and methods.

“Our investment reflects our commitment to safeguarding critical infrastructure and customer data in the face of an ever-evolving cyber risk environment.”

NOW READ: Here’s when City Power won’t pay up or fix your outage