Key Takeaways
- XET Solutions received R483 million from Ekurhuleni Metro between 2019 and 2023, a sum that investigators say is inflated by ghost employees and fraudulent billing.
- The company financed a R3.35 million private‑jet trip for former city manager Imogen Mashazi and companions to London in July 2022, with the payment routed through politically‑connected businessman Zesimdumise “Ze” Nxumalo.
- Senior Ekurhuleni officials allege that XET’s invoices include non‑existent staff – even the children of municipal employees – and that the firm does not deserve half of what it billed.
- A rushed year‑end settlement on 30 June 2022 saw seven invoices worth R48 million paid, five of which were submitted only that day, contradicting normal monthly payment cycles.
- XET was awarded a three‑year ERP contract in mid‑2023 to manage electricity automated meter reading for ~13,000 large power users; its implementation failed, resulting in no meter reads for the first quarter of FY 2023/24.
- The failed rollout coincided with a cyber‑attack that inserted keyloggers and spyware into Ekurhuleni’s billing servers, enabling a syndicate to slash or erase debts and create a R2 billion revenue shortfall.
- Investigations by OMA Chartered Accountants have confirmed the cyber‑crime syndicate’s control over the municipality’s IT infrastructure; disciplinary actions against suspended CIO Moloko Monyepao are underway, while XET and its alleged benefactors have not responded to queries.
Background of XET Solutions and Ekurhuleni Contracts
XET Solutions first entered Ekurhuleni’s procurement arena in 2019, gradually securing at least five separate contracts with the metro. By 2023 the firm had become a regular supplier on the municipality’s professional services panel, which lists skilled IT experts tasked with designing, implementing, and managing technology systems. The Sunday Times obtained payment statistics reports and invoice registers that reveal a steady flow of funds to XET, culminating in a total disbursement of R483 million over the period. These records have been corroborated by senior Ekurhuleni executives who spoke on condition of anonymity, confirming that the company’s financial relationship with the metro was both extensive and continuous throughout the years under review.
The Private Jet Junket and XET’s Financial Flow
In July 2022 XET financed a lavish three‑day shopping trip to London for former city manager Imogen Mashazi, her husband Raymond Mashazi, pharmacist‑turned‑businesswoman Dineo Seletswane, and an unnamed companion. The jet, a Dassault Falcon 900EX, cost R3.35 million. Payment was not made directly; instead, XET deposited R5.7 million into the account of ZIG Revenue Management, a company owned and directed by businessman Zesimdumise “Ze” Nxumalo. Nxumalo then transferred R3.35 million to Onyx Aviation in three transactions between 23 July and 1 August 2022 to settle the charter fee. Nxumalo told the Sunday Times he arranged the flight on behalf of Ntokozo Xaba, believed to be the founder and chair of XET, only to learn later that Mashazi—not Xaba—had been the passenger. At the time of the trip, Mashazi held the position of Ekurhuleni city manager while XET was simultaneously benefitting from lucrative metro contracts, raising clear conflict‑of‑interest concerns.
Allegations of Ghost Employees and Inflated Billing
Two senior Ekurhuleni executives, speaking anonymously, described XET’s billing practices as “systematic inflation” and accused the firm of charging for “ghost” employees who never participated in the projects they purported to support. One executive bluntly stated, “XET … does not deserve half the amount they billed. Their billing schedules even include the children, who don’t work for the municipality, of senior officials employed by the metro.” This claim suggests that invoices were padded with fictitious labour costs, possibly to siphon funds without delivering corresponding services. The allegation that even the offspring of municipal officials appeared on XET’s payroll underscores the depth of the alleged fraud and points to a possible network of insider facilitation.
Suspicious Invoice Patterns and Year‑End Rush
The financial records reveal an irregular payment pattern at the close of the 2021/22 fiscal year. On 30 June 2022—the last day of the financial year—Ekurhuleni processed seven XET invoices totalling R48 million. Five of those invoices were submitted only on that same day, with the largest amounting to R23 million and two others exceeding R7.5 million each. Notably, on 28 July 2022, the day Mashazi and her entourage departed for London, XET submitted two invoices each worth just over R2 million; both were paid the following day. Such rapid processing deviates from the metro’s standard monthly invoice‑settlement cycle, suggesting an effort to clear outstanding claims quickly, possibly to conceal the true nature of the expenditures before financial scrutiny intensified.
The Massive IT Rates Billing Scam (2023/24)
XET’s most consequential involvement came through a three‑year enterprise resource planning (ERP) contract awarded in mid‑2023 to manage Ekurhuleni’s electricity automated meter reading (AMR) infrastructure, meter‑data management, and billing services for roughly 13,000 large power users (LPUs). The ERP system, intended to replace legacy processes, was hosted on the Solar platform developed by Business Connexion Group, a Telkom subsidiary. However, senior executives told the Sunday Times that XET’s implementation was chaotic: in the first three months of FY 2023/24 (July‑September 2023) not a single LPU meter was read. Consequently, the metro billed LPUs on interim estimates, leading to substantial under‑billing. A letter from energy chief Tshilidzi Thenga to the mayoral committee in February 2024 noted that the remote‑metering service provider contract was discontinued on 1 July 2023, leaving all large power users to be billed on estimates and causing a revenue gap that later ballooned to an estimated R2 billion.
Failed Implementation and Billing Chaos
The failure to install functional meter‑reading equipment meant that the ICT department, which XET was supposed to support, never delivered the promised services. Thenga’s correspondence highlighted that while the ICT department claimed it would assume all functions of the remote‑metering service provider, “none materialised except the ARM,” and field activities were absent. This breakdown in service delivery forced the municipality to rely on estimated consumption figures, which systematically undervalued the actual electricity usage of major consumers. The resulting deficit not only strained Ekurhuleni’s finances but also eroded trust in its ability to protect revenue streams from large‑scale users, a critical component of the metro’s economic stability.
Cyber‑attack and Insider Collusion
When the revenue shortfall became apparent, Ekurhuleni commissioned OMA Chartered Accountants to investigate. OMA’s findings revealed that a cyber‑crime syndicate had seized control of the metro’s IT billing infrastructure. Investigators discovered surveillance tools and malicious spyware embedded on critical servers and workstations responsible for authentication and access control. Keylogging software silently captured usernames, passwords, and other credentials, effectively opening the municipality’s networks to criminal manipulation. The attackers altered billing data, reducing or entirely wiping out debts for rates and taxes, thereby facilitating fraudulent rates‑clearance certificates that accelerated property sales. The scale of the deception—estimated at more than R2 billion in lost revenue—points to a sophisticated operation that likely required insider knowledge to bypass security measures and to time the alterations with billing cycles.
Political and Administrative Fallout
In the wake of the hacking scandal, Ekurhuleni swiftly suspended Moloko Monyepao, the chief information officer whom former city manager Mashazi had promoted to CIO in April 2022. Monyepao was hauled before a disciplinary hearing, which remains ongoing. Neither Monyepao nor alleged XET benefactor Ntokozo Xaba responded to the Sunday Times’s requests for comment, and the metro itself did not reply to inquiries sent on the Friday preceding publication. The silence from key figures underscores the sensitivity of the matter and suggests that internal investigations may be hampered by potential loyalties or fear of reprisal. The case has prompted broader questions about oversight, conflict‑of‑interest disclosures, and the adequacy of procurement controls within Ekurhuleni’s governance framework.
Broader Implications and Ongoing Investigations
The XET saga illustrates how intertwined financial mismanagement, inadequate contract oversight, and cyber‑vulnerability can precipitate massive fiscal losses in a metropolitan authority. The alleged ghost‑employee schemes and inflated invoices point to weaknesses in verification processes that allowed fictitious labour costs to slip through approvals. Simultaneously, the successful cyber‑infiltration reveals that even when external vendors are scrutinized, internal IT defenses can be compromised, enabling criminals to exploit the very systems meant to safeguard revenue. Ongoing investigations by OMA, coupled with the disciplinary proceedings against Monyepao, will likely determine whether criminal charges are filed and what remedial steps Ekurhuleni must take to restore fiscal integrity. Ultimately, the episode serves as a stark reminder for South African municipalities to tighten supply‑chain controls, enforce strict conflict‑of‑interest disclosures, and bolster cyber‑resilience to prevent similar looting in the future.