Legal Aid South Africa has ordered every employee to change their password after phishing emails earlier this month posed as court papers. The organisation says it has not confirmed a successful breach. The Information Regulator has not received a security-compromise notice.
What happened
ITWeb reported on 20 October 2026 that phishing emails circulated around 8 and 9 October. They claimed to be final demands or summonses from the National Prosecuting Authority. Staff who opened an attached PDF were asked for login credentials. It is not known whether anyone entered them.
Internal notices told staff to attend a compulsory cyber security webinar and referred to a recent cyber attack. A separate note, headed Mandatory Password Change for All Users, said every user would be prompted to change their password at the next logon. Spokesperson Pateka Quwe said Legal Aid SA is not aware of any breach that compromised its systems or information.
Who is affected
This is a South African organisation, not a product flaw. The pattern is the one that hits local offices.
- Legal Aid SA staff who received NPA-themed emails around 8 and 9 October.
- Anyone who opened the attached PDF and typed a password.
- South African firms whose staff get fake summonses, tax letters, or bank demands in the same style.
What to do now
Treat a summons-themed attachment as hostile until it is confirmed on a known channel, and reset any password that may have been typed into it.
- Warn staff that a PDF claiming to be an NPA summons is a current local lure, not routine spam.
- If anyone entered credentials, reset that password, revoke active sessions, and check mailbox rules for forwarding.
- Enforce multi-factor authentication on email if it is not already on.
- If personal information was accessed by an unauthorised person, notify the Information Regulator as soon as reasonably possible under POPIA.
What this means for South African businesses
Legal Aid SA has not confirmed that anyone handed over a password, and the regulator has not been notified of a compromise. The useful fact for other offices is the lure: a fake legal demand with a PDF that asks for a login.
A legal-aid office is a realistic stand-in for a South African professional firm. One convincing summons PDF is enough to harvest a mailbox password that is often reused on Microsoft 365, and that is the exposure most small firms actually have.
Source: ITWeb, Legal Aid SA resets all passwords after phishing attack.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.