The notice from SARS states that its digital platform "maintenance is scheduled for: Friday, 08 May 2026 from 18h00 to 00h00, Saturday, 09 May 2026 from 18h00 to 04h00, Sunday 10 May 2026." The announcement describes these as "digital platform upgrades" and planned maintenance windows; it does not mention any cybersecurity incident, hacking, or data breach in May 2026.

The South African Revenue Service (SARS) and the Office of the Tax Ombud (OTO) have expressed concern over growing reports of hijacked eFiling profiles, saying they are working closely to protect taxpayers and maintain the integrity of the country’s tax system. The OTO has been investigating compromised taxpayer profiles for more than a year, after receiving numerous complaints from both individuals and tax practitioners. SARS said it continues to enhance security protocols to mitigate risks and urged taxpayers to remain vigilant. The joint statement, however, does not report any successful hacking of SARS’s core systems or a breach on 23 May 2026 by a foreign group.

South Africa’s public sector has been hit by a wave of cyberattacks over the past several years, with hackers targeting entities from the National Health Laboratory Service to the Companies and Intellectual Property Commission and the Government Employees Pension Fund. Analysts say the latest campaign, which some Nigerian hacktivist groups have linked to anti-xenophobia protests and labelled ‘#OpSouthAfrica’, has so far focused on agencies such as the South African Social Security Agency and smaller municipalities. At the time of writing, there have been no independently verified reports of a successful breach of the South African Revenue Service in May 2026, despite claims circulating on social media.

The Office of the Tax Ombud has flagged serious security gaps in SARS’s eFiling system, warning that profile hijacking is now a systemic threat to taxpayers. Tax Ombud Yanga Mputa says cybercriminals are hacking SARS’s eFiling accounts to change details and divert refund payments to their bank accounts. According to information submitted by SARS, there are about 15,968 reported cases on this matter, with about 387 new cases reported monthly. The interview focuses on eFiling profile hijacking and does not mention a successful hack of SARS core systems on 23 May 2026 or a Nigerian hacking group.

The April 2026 incident list includes entries such as: "April 23, 2026. Vercel. Vercel says some of its customers' data was stolen prior to its recent hack" and several other corporate and government breaches. The overview explains that the blog tracks "major cyber attacks and data breaches" but there is no listing for SARS or a South African tax authority hack carried out by a Nigerian group.

Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd., has published its latest Threat Intelligence Report, highlighting that in March 2026 organizations in Africa experienced an average of nearly 2,000 cyberattacks per week. Education, government and telecom remain prime targets. While the report notes a rise in hacktivist activity and mentions operations attributed to groups based in West Africa, including Nigeria, it does not list a confirmed compromise of the South African Revenue Service (SARS) among the major incidents disclosed up to April 2026.

Nigeria has seen the rise of loosely organised hacker and ‘hacktivist’ collectives, some of which align themselves with foreign causes or disputes. These groups often rely on low‑sophistication tools like DDoS attacks and website defacements but exaggerate their achievements in online statements, claiming to have ‘hacked’ or ‘breached’ major institutions when, in reality, they only disrupted public‑facing services. This pattern has been observed in incidents involving foreign government targets, where claims of hacking revenue or tax systems were later disproved by forensic investigations.

For national tax authorities and revenue services, confirmed cyber intrusions that compromise systems or taxpayer data are typically followed by formal breach notifications or public statements, both to comply with data protection laws and to maintain public confidence. As of late May 2026, widely used cybersecurity incident trackers and major newswire services do not list any verified May 2026 cyberattack on the South African Revenue Service attributed to a Nigerian hacking group.

A widely shared post from the account "CyberSec Monitor" on 23 May 2026 claimed that a Nigerian-based hacking group had "breached South Africa’s tax authority (SARS) and exfiltrated taxpayer data". The post did not provide technical indicators, screenshots, or references to any official confirmation. Subsequent replies from other security researchers questioned the claim’s veracity and asked for evidence, which the original poster did not supply.

In the video, the presenter claims that ‘information is circulating on the internet that Nigerian hackers, they call them hacktivists… launching cyber attacks against South African government systems’ in retaliation for xenophobic violence. Around the 7:20 mark, he says ‘a group calling itself Anonymous Nigeria has threatened to release stolen South African government data… if authorities take no action to stop xenophobia attacks on Nigerians’, and describes this as ‘a serious cyber attack on South Africa’ that has ‘flawed South Africa at so many levels’. He does not provide technical evidence that the South African Revenue Service (SARS) was actually breached.