Cybersecurity researcher Joel Cedras has warned that the Department of Home Affairs (DHA) cannot guarantee its upcoming digital IDs will be immune to cyberattacks.

Cedras, a third-year university student, recently made headlines after discovering and disclosing a data breach affecting Gauteng’s e-Panic button app.

As a first-year student, he was part of the team that exposed widespread fraud involving South Africa’s Social Relief of Distress grants. A hacker group later claimed to have stolen more than R185 million from the system.

MyBroadband contacted Cedras for his thoughts on the security of Home Affairs’ upcoming digital ID system, which was first live-demoed on 1 October 2026.

Home affairs minister Leon Schreiber revealed several new security measures implemented in the digital ID system, which is expected to roll out countrywide only after 2030.

In the initial gazetting of digital IDs, Schreiber said cryptographic keys, device binding, and biometric verification features would protect the system.

These security measures are aimed at preventing criminals from exploiting the digital ID system to steal people’s identities.

They would also help avoid a repeat of the problems plaguing South Africa’s green ID booklet, which Smile ID previously identified as the most frequently forged identity document in Africa.

The device-binding meant that even if a person had access to another’s login credentials for a digital ID, they could not access that person’s account unless they possessed the bound smart device.

An additional layer of biometric authentication, including facial recognition, would provide further protection. More security features were announced in October.

In his live demo of the country’s first working digital ID, Schreiber showed that citizens would be in full control of the personally identifying information others could access.

He demonstrated that people with a digital ID could initiate the sharing of their information using a QR code.

This QR code could be adjusted depending on what information the holder wanted to share, with consent given on a per-item basis, including names, identity numbers, nationalities and issuing country.

When a government official or an employee at an institution like a bank scans the code, the user must approve or deny the request.

“Digital ID cannot and will not be a photograph of your ID card on your phone. That is not what it is. Digital ID is a remote verification tool,” said Schreiber during the demo.

“It is a secure tool, linked to your biometrics, which you can use to confirm who you are.”

Digital ID system only as secure as its weakest link

Joel Cedras, cybersecurity researcher and university student.
Cedras told MyBroadband that while digital IDs were mostly a good idea, there was a big difference between building secure technology and actually keeping it secure when it was live.

“However, Home Affairs can make attacks difficult, detect them quickly, and ensure that a breach doesn’t compromise the entire system.”

This would require rigorous testing, including internal penetration testing, monitoring, strict access controls, and a process for external security researchers to report vulnerabilities.

“Home Affairs should also try to minimise the risk of a third-party platform causing harm to the system or data,” Cedras said

He said there was no reason to assume that criminals wouldn’t target the digital ID system through third-party providers.

South Africa’s insurance sector recently suffered a wide-ranging data breach that affected several individual companies, including Hollard Insurance, Guardrisk, LegalWise and Samwumed.

This followed a breach of MIP Holdings, a third-party service provider targeted by a notorious ransomware group. The attackers gained access through MIP’s Atlassian-developed Jira platform.

As an example, Cedra said one potential attack vector for digital IDs could be through the Company and Intellectual Property Commission (CIPC), which was breached in 2024.

“CIPC already interfaces with Home Affairs to verify people’s identities,” said Cedras, adding that the 2024 breach had exposed personal information of South Africans.

“Home Affairs could have a brilliantly secure system, while another government department or private company using its verification services could be much less secure,” he said.

Another attack vector could be through the infrastructure that the digital ID system uses, hosted by the South African IT agency (SITA).

“Not too long ago, I identified more than 5,000 potential security vulnerabilities on SITA’s network and another 4,400 on government infrastructure outside SITA,” Cedras said.

“While there were very few vulnerabilities on DHA systems, those other systems still interface with DHA.”

MyBroadband reached out to the department regarding Cedras’ concerns, but it had not provided feedback by the time this article was published.

Concerns around recovering digital IDs

The first live digital ID in South Africa, revealed on 1 October 2026.
Cedras said that one of his biggest concerns with the incoming digital ID system was how an identity could be used and recovered.

“What happens if a criminal manages to register someone else’s identity on their own phone? Or convinces a victim to approve an identity request without understanding what they’re agreeing to?”

“Even if the encryption is perfect, it becomes meaningless if criminals can manipulate the processes surrounding it,” he said.

To protect against this, Home Affairs would need a reliable process for revoking and recovering digital IDs without creating another opportunity for identity fraud.

This would limit the damage if a person’s digital ID was stolen alongside their smartphone, or if their phone was infected with malware and the ID compromised through the app.

“I don’t think digital IDs are necessarily less secure than physical ones. If implemented properly, they could actually make identity fraud much more difficult,” Cedras said.

Cedras suggested that allowing independent cybersecurity researchers to test the system before rollout and opening a bug bounty programme would help address security concerns.

“They’d be the first organisation in the country to introduce a bug bounty, but it would really encourage skilled white hats from around the world to help secure the system,” he said.

Source: https://mybroadband.co.za/news/security/671608-young-hacker-who-exposed-government-security-flaws-raises-concerns-about-south-africas-digital-ids.html