Attacks expose weak govt cyber protections, experts say

As the defence and veteran affairs ministry becomes the fourth state institution in 21 months to suffer a hack, cybersecurity experts concur that government must mandate cybersecurity best practices of its agencies or watch as the situation worsens.

“Your situation depends on whether anybody is paying attention and wants to hack you," says Lian Aldrich, a co-founder of the penetration testing and adversary simulation service provider Aphotic Security.

"We can now safely assume that the international groups have started to pay attention – and this is evident by the fact that the time elapsed between attacks has decreased,” he said.

Aldrich explains that, despite Namibia’s population and economy size relative to other nations, the country has a glaring vulnerability. “We have a fairly large attack surface. We had about 900 000 exposed systems in the first half of 2026.”

The cyberforensic expert and director of the security and intelligence operations firm, Intelligence i1, Andrew Fordred, explains that it is precisely Namibia’s position as a small economy that may be sheltering the country from the full impact that such cyber events may bring.

“The fact that we are such a small nation that is not making big moves is what is protecting us at the moment, so I think this [NDF hack] will fade quickly, but the dam wall has to open, and what are the consequences if it opens?"

He added: "This might not be too serious, but what if, for example, the ministry of finance gets hacked? Why are we waiting for that to happen?”

Fordred confirms that at the time of publishing, it did not appear that the compromised data in the latest hack had yet surfaced on the dark web, nor that the information compromised in the event could have serious consequences.

Namibia’s lack of cyber-resilience could hold serious consequences for its international rankings and co-operation, Fordred explains.

“If an institution like the ministry of finance gets hacked, that will affect our rankings on international listings like the Financial Action Task Force list that we just got off of. If we want to do business with European nations, they are increasingly going to demand that we have ISO2700/1 in place. We need to get that in place, and we need to train locals on it,” he says.

ISO2700/1 is a set of guidelines and standards that is currently regarded as the leading standard for managing information security management systems globally. “If we don’t do that, the institutions we want to work with will decline to do business with us, and we won’t get the necessary support that we need from those countries,” Fordred warns.

‘Will not there’

Aldrich notes that cybersecurity spending at ministries and other state institutions is not mandated with funds allocated, and this leads to fractured institutional will which is at the mercy of allocations for discretionary spending. “Government institutions can only act according to the law and at the moment, the will is not there," he says.

"What would best address it is legislation. Currently, the Cybercrime Bill does include a mechanism which allows Cran [the Communications Regulatory Authority of Namibia] to make a recommendation to the minister that testing can be compelled, but we cannot get around this without legislation.”

At present, stakeholder consultations for the Cybercrime Bill are being conducted before final adjustments are to be made ahead of its discussion in parliament. Work on the bill has been ongoing since 2013.

Fordred and Aldrich both warn that human actors remain a serious vulnerability. “We cannot blame software, software does not act alone,” says Fordred, with Aldrich noting: “There is no patch for social engineering.”

“These attacks are all 100% human-related and are able to be exploited because they have vulnerabilities on their servers,” says Fordred, who explains that many government agencies conduct their work on outdated systems.

Aldrich explains that many human vulnerabilities arise as a result of faulty support infrastructure. “It is a very human thing to want to point a finger and assign blame, but there is more likely a fault in the supportive infrastructure. If you are a soldier at the NDF [National Defence Force], it is not in your wheelhouse to know how to not get phished. So, while there is expenditure in government in hardware and so forth, there is very little expenditure in third-party validation of our systems,” he says.

Defence hack

Cran’s Nam-CSIRT (cybersecurity incidence response team) confirmed that unauthorised activity, linked to the RansomHouse ransomware group known for double-extortion tactics, occured within the ministry's network environment, stating that it remains actively involved in technical support, investigation activities, remediation measures and post-incident reviews.

Cran chief executive and head of Nam-CSIRT, Emilia Nghikembua, also called for keener investment in cybersecurity, among others. “The collective security of Namibia’s digital ecosystem depends on timely reporting, proactive information sharing and continuous investment in cybersecurity preparedness.

"We urge all organisations to strengthen their cyber defences and work closely with Nam-CSIRT to safeguard critical systems, data and services that citizens depend upon every day,” she said in a joint statement from Cran and Nam-CSIRT.

– [email protected]