DATA SUBJECT NOTIFICATION OF SECURITY COMPROMISE IN TERMS OF SECTION 22 OF THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013 (“POPIA”)

23 October 2026

Dear Student / Parent / Guardian / Data Subject,

Formal notification of security compromise

On or before Monday night, 19 October 2026, our information technology systems were compromised by a ransomware attack. The precise time at which the attack commenced, and the full extent of the compromise have not yet been established.

The attack affected our main server, a significant number of networked workstation computers, including CAD workstations, and recent server backups. The ransomware encrypted or otherwise rendered inaccessible or damaged a substantial amount of data. Certain workstations and devices have had to be wiped as part of the recovery process.

The affected systems were used in connection with the Institution’s operations, including academic and administrative activities. Student-related records and other information stored on the affected systems may therefore have been affected.

At this stage, the full extent of the data loss and the categories of information affected remain under investigation. We are still determining which files can be recovered from available backups and which information may have been permanently lost or damaged.

The primary effect of the incident identified to date is the encryption, damage to and loss of access to data and systems. Ransomware attacks commonly seek to disrupt access to information and demand payment for its recovery.

However, we cannot presently confirm whether the attackers accessed, copied, extracted or otherwise acquired personal information held on the affected systems. Although no unauthorised disclosure of personal information has been confirmed at this stage, the possibility of such access or disclosure cannot be excluded.

We are investigating the incident to establish whether personal information was affected, what categories of information may have been involved, and whether any information may have been accessed or obtained by an unauthorised person. We will communicate material developments to affected data subjects where appropriate.

Because the investigation and data-recovery process are ongoing, we cannot yet provide a definitive list of the personal information that may have been affected.

Depending on what was stored on the affected systems, the information potentially concerned may include student records, academic or administrative records, contact details and other personal information held by the Institution. This does not mean that all such information was necessarily affected or accessed by the attackers.

Our student management system and email services were reported to be operational following the incident. Information stored in cloud services, including OneDrive, was also reported to be unaffected. These systems are being distinguished from the affected server and workstations as the investigation progresses.

Upon identifying the incident, we commenced measures to contain the compromise, secure the affected environment and restore our systems and data.

These measures include:

1. Isolating, cleaning and rebuilding affected devices and systems, including wiping certain workstations where necessary.
2. Working to restore data from available backups and determine the extent of the data that can be recovered.
3. Investigating the cause, scope and effects of the ransomware attack, including whether personal information may have been accessed or extracted.
4. Taking steps to secure our systems and reduce the risk of further compromise.
5. Reviewing the integrity of affected systems before restoring them to operational use.

The restoration process remains ongoing, and we cannot yet guarantee that all affected information will be recoverable. We will continue to assess the incident and take appropriate remedial measures as further information becomes available.

The potential consequences of this incident depend on the information affected and whether any personal information was accessed or acquired by an unauthorised person. These consequences may include:

1. Temporary or permanent loss of access to personal information or records. This only concerns past students, not current students nor applicants. We will in due course be able to assess which cohorts’ information can be recovered or are permanently lost or damaged.
2. Disruption to academic, administrative or other services.
3. An increased risk of phishing, fraudulent communications or impersonation if personal information that may have been obtained by the attackers.
4. A risk of identity fraud or other misuse of personal information, depending on the nature of any information accessed or disclosed.

At present, we have not established that any personal information has been disclosed or misused. However, until the investigation has progressed sufficiently, we cannot rule out these possibilities.

As a precaution, we recommend that you:

1. Remain vigilant when receiving emails, text messages, telephone calls or other communications requesting personal information, payment, account credentials or other sensitive details.
2. Verify unexpected requests for information or payment independently using contact details obtained from a trusted source.
3. Do not click on suspicious links, open unexpected attachments or disclose passwords, PINs or other authentication details in response to unsolicited communications.
4. If you use an account or password that may have been exposed, change the password through the official service and enable multi-factor authentication where available.
5. Monitor your accounts and remain alert to suspicious activity or communications purporting to originate from the Institution.

If you believe that your personal information has been misused, or you receive a suspicious communication claiming to be from the Institution, please notify our Information Officer, Inez Shaw, using the contact details below.

We will continue investigating the incident, assessing the impact on personal information and restoring affected systems and data. We will provide further information or updates where material developments arise that affect data subjects.