Minister Siviwe Gwarube on interim findings and recommendations of National Investigation Task Team on 2025 NSC examination breach

The Minister of Basic Education, Ms Siviwe Gwarube, today briefed the public on the interim findings and recommendations of the National Investigation Task Team (NITT) regarding the breach involving 2025 National Senior Certificate (NSC) examination materials.

Earlier in the day, Umalusi approved the 2025 National Senior Certificate results and confirmed the credibility and integrity of the 2025 NSC examinations, and, as part of this process, engaged with the interim findings and recommendations placed before it.

In welcoming Umalusi’s approval , the Minister said, “Umalusi’s approval today is a clear assurance to every candidate and every parent: the 2025 NSC remains credible. Where wrongdoing is proven, it will be addressed firmly – but we will not allow a small number of offenders to taint the achievements of the overwhelming majority.”

This media statement follows the NITT’s presentation of its interim findings and recommendations to the Department of Basic Education (DBE) and Umalusi this week, and to the public earlier today, as part of a process-grounded communication approach that preserves the independence of the investigation and avoids confusion.

1. Background and commitment to integrity
As the Minister stated previously, the breach was detected through the strength of our marking and quality assurance systems. Markers are our first line of defence, and the fact that anomalies were identified and escalated through established protocols demonstrates that the NSC system is designed to detect irregularities and act decisively to protect honest learners.

The Minister reiterated: “We will not compromise the future of thousands of honest learners because of the actions of a few, and we will leave no stone unturned in ensuring accountability and safeguarding the value of the NSC certificate.”

2. The NITT: mandate, scope and independence
In recognition of the seriousness of this matter – and the need for clear independence – the DBE established the National Investigation Task Team (NITT). The DBE has been clear that it would not conduct a final investigation on this matter internally and that an independent process was essential to ensure public confidence.

2.1 Independence and composition
The NITT is chaired by Prof Chika Sehoole, who is a distinguished scholar and the ex-dean of the Education at the University of Pretoria, with Mr Brian Schreuder who was the Superintendent General of Education, as Deputy Chair. Its membership includes education experts, labour and union representatives, SAQA representation, and an Umalusi observer. DBE’s role has been to support the work of the NITT without interfering with its deliberations.

The NITT’s work was conducted independently, with the DBE providing logistical and technical support only, so as not to contaminate the Task Team’s deliberations. This independence is essential to public confidence and to Umalusi’s oversight role in safeguarding the credibility of the NSC.

2.2 Mandate and scope of the investigation and methodology used
To ensure a meaningful investigation, the NITT interpreted its mandate to include:

• establishing both the source of the breach and the spread (extent) of the breach;
• identifying learners who accessed leaked materials; and
•  recommending how to address the breach to protect the credibility of the 2025 NSC and to prevent recurrence.

In executing this mandate, the NITT applied established investigation protocols and a mixed-methods approach, triangulating evidence across forensic work, statistical analysis, investigative marking and structured interviews (including with learners, invigilators, chief markers and identified officials). This approach strengthens confidence that interim conclusions are evidence-led and proportionate.

It must be noted that other examination irregularities do occur, but those not linked to this specific breach fall outside the NITT’s mandate and are dealt with through the established Provincial Examination Irregularities Committees (PEIC) and National Examination Irregularities Committee (NEIC) processes.

3. Interim findings and recommendations presented by the NITT
3.1 Source
On the evidence available to date, the NITT reported that the breach originated within the DBE’s secure national examinations environment – that is, within the secure environment where NSC question papers are set, processed and managed.

The NITT further indicated that, on the evidence available to date, a DBE official whose child was an NSC 2025 candidate is alleged to have been involved in this breach, with the learner subsequently forming part of the distribution chain. The NITT also noted that a possible second suspected official remains subject to corroboration through the ongoing forensic and investigative work.

However, the NITT emphasised that confirming the exact extraction pathway remains part of the continuing forensic work. At the time of reporting, the forensic investigation had not yet yielded definitive evidence pinpointing the specific machine and time of extraction from the secure DBE server, and the forensic scope has been expanded, with investigations with law enforcement continuing.

3.2 Extent and localisation
Based on evidence available to date, the NITT reported that the breach was contained to 40 candidates in the Tshwane area and therefore localised. This reflects a very small portion in comparison to the over 900 000 candidates who wrote the NSC exams in 2025.

In communicating these interim findings, the DBE will avoid public naming of schools. The NITT used school-level analysis only as an investigative tool to identify potential anomalies. Culpability attaches to implicated individuals, not institutions, unless evidence establishes otherwise. Schools in the Tshwane area should not be presumed implicated by association.

The NITT’s overarching interim finding and recommendation is that, given the limited number of implicated candidates relative to the full NSC cohort, the integrity of the NSC examinations as a whole remains intact, enabling the release of results for the broader cohort while ensuring due process for those implicated.

In addition, standardisation indicators did not reveal abnormal patterns consistent with systemic compromise of the examinations, supporting the conclusion that this matter is contained rather than widespread.

3.3 Papers implicated
The NITT reported that evidence currently confirms seven leaked question papers, limited to the following subjects and papers:

• English Home Language: Paper 1, Paper 2 and Paper 3;
• Mathematics: Paper 1 and Paper 2; and
• Physical Sciences: Paper 1 and Paper 2.

3.4 Circulation methods and emerging risks
The NITT reported that the leaked materials were shared through a combination of digital and physical means, including removable storage, electronic messaging, screenshots and printed copies. The NITT further cautioned that evolving technologies – including AI-enabled tools – can be used to disguise misconduct, reinforcing the need to modernise prevention, detection and invigilation controls.

3.5 Recommended results management and due process
On the NITT’s recommendation, results for the 40 implicated candidates will be withheld temporarily while the official irregularity processes are completed.

As part of these processes, each of the 40 candidates will be subjected to an independent hearing. Where a candidate is found guilty by the independent presiding officer, this finding, together with recommendations, will go to the Provincial Examination Irregularity Committee and thereafter the National Examination Irregularity Committee. Umalusi will be the final arbiter.

Candidates found guilty may have their results in the relevant subjects nullified and may be further sanctioned. Sanctions include barring from writing the NSC examinations for up to three examination sessions.

Umalusi has indicated that it is satisfied with the NITT’s interim findings and recommendations, and these have been accepted as a basis for protecting the integrity of the examinations as a whole while ensuring due process for implicated candidates.

Going forward, Umalusi will continue monitoring developments and ensure correct processing so that non-implicated candidates receive results, while any verified new implications are actioned appropriately.
For avoidance of doubt, examination irregularities not linked to this specific breach continue to be processed through the established PEIC and NEIC mechanisms, in line with standard practice and due process.

4. Consequence management, security strengthening and ongoing oversight
4.1 HR consequence management
The Department of Basic Education has already taken steps to address the alleged internal involvement, including the precautionary suspension of suspected officials earlier in the process.

In addition, the Department is implementing the NITT’s recommendations to institute investigations and disciplinary proceedings against implicated officials; to continue the forensic investigation into unlawful access to and distribution of examination materials; and to support criminal proceedings where the evidence warrants it.

The Minister said: “Those who compromise the NSC do not only break rules, they also attempt to steal opportunities from honest learners. We will pursue accountability through every appropriate disciplinary and criminal process, in line with due process once the necessary investigations are concluded.”

4.2 Criminal investigation, forensics and security response
The matter has been reported to the South African Police Service (SAPS) for investigation of the criminal aspects.

A forensic service provider was appointed to investigate electronic devices and relevant evidence that may have facilitated the breach, and the forensic scope has been expanded in order to establish the extraction source/timeline and corroborate involvement of any additional suspects, as applicable.

4.3 Strengthening examination security and invigilation
The DBE is implementing measures aligned with the NITT’s recommendations to:

• Strengthen end-to-end security across the examinations value chain, including tighter controls for handling, processing, storing and managing examination papers within secure environments;
• Maintain and enhance high-risk centre monitoring, informed by evidence and risk profiling;
• Strengthen and standardise candidate screening and processing prior to entry to examination rooms across centres;
• Investigate and act on invigilation complacency/laxity, and strengthen invigilation oversight – recognising practical risks in certain venues that constrain invigilator movement; and
• Update controls to keep pace with evolving technology risks (including wearables and AI-enabled tactics) and strengthen prevention and detection accordingly.

In addition, the DBE is undertaking measures to strengthen its information security capacity and controls in the examination’s environment (including, among others, strengthening access control, secure file transfer mechanisms, encryption, and removable media controls).

4.4 Work continues
The NITT’s work will continue, including ongoing triangulation, investigative marking, additional interviews and expanded forensic work. The NITT may refine its recommendations – particularly on strengthening security within secure examinations environments – and may supplement its report as further verified evidence emerges.

Where any further verified developments emerge, DBE and Umalusi retain the right and ability to act accordingly, consistent with due process and the integrity of the system.

5. Appreciation and public assurance
The Minister thanks the NITT for its independent, rigorous work – particularly the sustained work through the festive period – and thanks the DBE officials and professionals who supported the investigation and the NSC integrity processes over this period.

The Minister also reiterates that broader examination irregularities not linked to this specific breach continue to be addressed through the established PEIC and NEIC mechanisms, as is standard practice.

6. Security of candidate data ahead of the official release of the 2025 NSC results
In response to the EduMarks matter – where 2024 NSC candidate data was unlawfully traded by a third party ahead of the official results release – the DBE initiated a forensic cybersecurity investigation into the unauthorised disclosure of the 2024 NSC results and the systems, processes and stakeholders involved in handling, storing, transmitting and disseminating results.

The investigation identified key weaknesses and made recommendations, and the DBE has since developed a mitigation plan to implement them.

In giving effect to these recommendations, the DBE is:

• strengthening the security of results distribution by moving toward a more centrally controlled distribution environment;
• making the use of the DBE’s approved secure file-transfer system mandatory;
• tightening access control and authentication;
• strengthening encryption and data protection; and
• introducing stronger data loss prevention measures and controls over removable media, alongside formalised secure communication protocols and ongoing cybersecurity training.

For the 2025 NSC results, all universities (through Universities South Africa (USAf) and the media will only receive the results under embargo 24 hours before the official release and going forward all partners in the results supply chain will be subject to vulnerability audits to ensure that every link in the chain meets the required security standard. This is critical to protecting the integrity of the NSC processes.

We regret the delay this will cause on the final admissions to higher education institutions but this inconvenience is necessary to protect the integrity of the NSC processes.

“South Africa can have confidence that the NSC system remains credible: irregularities are detected, investigated with rigour and addressed through firm consequence management – while protecting the integrity of the qualification for the overwhelming majority of honest learners.” – Minister Siviwe Gwarube concluded.

#GovZAUpdates