South Africa’s Lengau supercomputer has faced a crypto-mining attack, exposing security concerns around the ageing system as the country prepares to replace it with a more powerful machine.
The breach affected parts of the Lengau high-performance computing environment at the Centre for High Performance Computing (CHPC), which operates under the Council for Scientific and Industrial Research (CSIR). The disclosure comes as South Africa prepares a major upgrade that will reduce its reliance on the decade-old system.
Lengau Supercomputer Hit by Crypto-Mining Attack
The security incident occurred in late May 2026. According to a written parliamentary response from South Africa’s Minister of Science, Technology and Innovation, Blade Nzimande, attackers gained unauthorised access to parts of the Lengau environment. They then deployed cryptocurrency-mining malware on the affected components.
The attack did not compromise the entire national cyberinfrastructure environment. Instead, the incident remained confined to affected parts of the high-performance computing system. The CHPC took containment measures and brought in specialist cybersecurity teams to investigate and remediate the breach. Earlier reports also said the CHPC took Lengau offline after detecting the intrusion. The system was later restored after security measures were implemented.
Ageing Infrastructure Played a Role
The attack has drawn attention to Lengau’s age. The supercomputer entered service in 2016. At the time, it ranked among the most powerful computing systems in Africa and delivered roughly one petaflop of processing power. A decade later, however, parts of the system have become harder to maintain.
Nzimande said some components are ageing, technically constrained or no longer fully supported by their original vendors. These legacy issues contributed to the vulnerabilities that enabled the breach. The incident therefore highlights a broader challenge for research institutions. Older infrastructure can remain useful for years, but maintaining its security becomes more difficult as technology and threats evolve.
Why Hackers Used Lengau to Mine Cryptocurrency
The attackers targeted more than data. By installing cryptocurrency-mining malware, they attempted to use Lengau’s considerable computing power for their own financial benefit. Cryptocurrency mining requires significant computing resources. High-performance systems can therefore become attractive targets when attackers find a way to access them. Instead of paying for computing hardware and electricity, criminals can exploit someone else’s infrastructure.
For a research supercomputer, that creates an additional problem. Unauthorised mining can consume processing capacity that researchers need for legitimate workloads. It can also increase energy consumption and place additional strain on the system.
Lengau Supports Scientific Research
Lengau is more than a large computing cluster. Researchers have used the system for climate modelling, medical research, astronomy and other computational workloads. It has also supported areas such as bioinformatics, genomics and artificial intelligence.
During the COVID-19 pandemic, for example, Lengau supported genomic analysis and processing related to SARS-CoV-2 sequencing. That role makes the security of the system important beyond the technology sector. A prolonged disruption could affect research projects that depend on access to high-performance computing.
South Africa Is Replacing Lengau
The cyberattack comes at an important moment for South Africa’s computing infrastructure. The country is preparing a new 4-petaflop high-performance computing system to replace Lengau. The new machine will offer roughly three times Lengau’s theoretical peak performance.
The government has allocated R292 million to the National Integrated Cyberinfrastructure System (NICIS) for the 2026/27 financial year. The funding will support technology, infrastructure, research, human resources and operations. The replacement will happen in phases.
According to Nzimande, the first phase should become operational by the end of November 2026. The full system upgrade is expected by the end of March 2027. This phased approach should allow researchers to continue accessing national computing services while the new platform comes online.
The Upgrade Could Strengthen Security
The new system will bring more computing power, but the benefits should extend beyond performance. South Africa now has an opportunity to build stronger cybersecurity controls into its next-generation research infrastructure. Following the breach, the CHPC reinforced monitoring for abnormal workloads and suspicious authentication activity.
Cybersecurity specialists from the CSIR’s Defence and Security cluster have also been involved in forensic analysis and remediation. These measures could help the current system remain secure until the replacement is fully operational. More importantly, the experience provides lessons for the design and management of the new platform.
Crypto Mining Shows the Value of Computing Power
The Lengau incident also highlights a changing threat to high-performance computing. Attackers do not always need to steal sensitive information to profit from a breach. Sometimes, the computing resources themselves are the target. A compromised supercomputer can provide criminals with access to processing power that would otherwise cost a significant amount of money to operate.
That makes cryptocurrency mining an attractive motive for some attacks. For research institutions, the risk is particularly serious because computing capacity is often shared across many users and projects.
What the Attack Means for South Africa
The breach exposes a difficult balance for South Africa. Lengau remains an important research asset, yet its ageing infrastructure creates security and maintenance challenges. At the same time, researchers continue to need more computing power for increasingly demanding workloads.
The planned replacement addresses the performance problem. However, the attack shows why cybersecurity must be treated as an equally important part of the upgrade. South Africa’s next supercomputer will need to deliver more processing power while also protecting the research and national infrastructure that depends on it.
You may also like: IMF Says South Africa’s Stablecoin Experience Offers Lessons for Emerging Markets
Editorial Takeaway
The crypto-mining attack on South Africa’s Lengau supercomputer is not simply a story about cryptocurrency. It highlights the risks that ageing technology can create for critical research infrastructure.
The timing is especially significant. South Africa is already moving towards a new 4-petaflop system, with the first phase expected by November 2026 and the full upgrade planned for March 2027.
