Between May and June 2026, South Africa’s Centre for High Performance Computing (CHPC) located at the Council for Scientific and Industrial Research (CSIR) experienced a cyberattack targeting the Lengau high-performance computing system. Attackers gained unauthorized access to the supercomputer where they deployed cryptocurrency-mining malware.
Minister of Science, Technology and Innovation, Blade Nzimande, explained to members of Parliament last week that the breach was being investigated. The breach occurred because of vulnerabilities associated with the decade-old high-performance computing system. The minister reported that only certain components of the system were affected by the breach and not the wider national cyberinfrastructure environment.
“Due to the legacy environment, some components are ageing, technically constrained or no longer fully supported by original vendors,” said Nzimande. “Going forward, the existing escalation, reporting and cyber-risk oversight arrangements will be strengthened to ensure faster response and executive visibility of cybersecurity incidents affecting strategic research infrastructure.”
To shore up defenses, several measures have been introduced or reinforced to monitor the systems and detect abnormal workloads, suspicious authentication activity, and other indicators of compromise. The CSIR’s Defence and Security cluster’s cybersecurity specialists have been engaged to conduct forensic analysis and remediation.
The CSIR will continue to monitor the situation to ensure Lengau remains secure.
Lengau arrived at the CHPC in 2016 and was, at the time, the fastest computer on the continent with a speed of one petaflop, surpassing the capabilities of Tsessebe, the system it replaced. Since its installation, Lengau has been used for climate modelling, medical research, and astronomy, among other research activities.
While it was impressive in 2016, the compute requirements for researchers have increased and so the CSIR and its National Integrated Cyberinfrastructure System (NICIS) have taken delivery of a new high-performance computing system.
This new system has a speed of four petaflops and will reduce researcher’s reliance on Lengau. The system will come online in phases to preserve continuity for ongoing research on Lengau. The first phase is expected to be complete by the end of November 2026 and the full upgrade will be finished by March 2027 at current estimates.
“The department recognises that the renewal of ageing core infrastructure, including the Lengau high-performance computing system, is necessary to maintain South Africa’s scientific competitiveness and to respond to increasing demand from the research and innovation community,” Nzimande said.
The NICIS has been allocated ZAR 292 million (US$ 18.2 million) for the 2026/27 financial year, which will be used to fund the new supercomputer. However, the funds are also earmarked to support human resources, governance and management, operations, research and human capacity development, and technology, equipment and built infrastructure. It isn’t clear how much of that figure was used to acquire the new supercomputer.