SUMMARY
Summary: Internal Control Collapse and Retaliation Against Gambakwe at UWC
Introduction (from timeline):
Gambakwe joined UWC as Infosec Manager in July 2023. Upon arrival, they found the university had no visibility of its network perimeter and had recently been hacked. On 12 October 2023, UWC lost R20 million through a hack of the OpenVPN student data chargeback system, where hackers used compromised student accounts to recharge Vodacom, Telkom, and MTN SIM cards.
Key findings:
-
System failure: Internal controls have collapsed. The whistleblower hotline is compromised, and ICS systems remain vulnerable.
-
Access blocked: No current staff can log in to fix the systems—they rely on a former employee (now at Checkers) for help.
-
Racial discrimination: Black employees are refused entry; the department is entirely Indian. Three black local staff hired by Gambakwe were fired on their first day.
-
Corruption & ghost employees: Private UWC data was moved offsite and compromised. 95 ghost employees were added to the system at Adapt-it. Procurement irregularities involve named individuals and the acting director.
-
Unqualified staff & outdated systems: Most department employees cannot log into any system and lack qualifications. Security systems and updated policies are missing—money is paid annually to rewrite policies that are never published (likely fund siphoning).
-
Retaliation against Gambakwe: Gambakwe recommended canceling a non‑performing supplier (First Technology). After pointing out a 30% inflated invoice (R1.8 million) on a contract renewal, they were suspended. Six of seven charges were baseless, but upon return, management launched another investigation for “bringing the department into disrepute” by reporting fraud. Gambakwe was ultimately dismissed.
