Hackers ‘trying to expose lotto winners’

Lottery operator Ithuba has come under attack from hackers attempting to access its website and expose the identities of players and winners, as bidding for the next lucrative lotto licence, to be awarded in 2025, heats up.

One of the accusations bandied about in the dirty tricks campaign is that Ithuba executives have tampered with lotto numbers to enrich themselves and their families.

In August the department of trade, industry & competition published a request for proposals for the fourth licence to operate the national lottery.

At least 18 companies have purchased proposal documentation from the National Lotteries Commission to prepare bids for the lotto licence, one of the biggest in the country, worth an estimated R50bn per eight-year licence.

Ithuba, which has been operating the lottery since 2015, has so far paid out R26,9 billion to about 700-million winning ticket holders. Annual ticket sales exceed R6-billion.

With the new licensing process under way, Ithuba has seen an increase in cyberattacks and on social media.

In September last year, the lottery operator had to approach the courts to interdict a person who obtained the names of jackpot winners, after hacking and accessing them on Ithuba’s website. The interdict prevented the person from using, distributing, copying, publishing or implementing the small amount of data they obtained. The culprit, who obtained up to 20 names of players, was also ordered to delete or destroy the information.

“We took that person to court because we needed to protect our players’ information,” Ithuba CEO Charmaine Mabuza said in an interview with the Sunday Times.

She said some people had used the interdict as “evidence” to somehow prove that the operator’s IT systems are not secure — “a claim we fundamentally reject”.

“We are in the bidding period ... we can expect the noise to start.”

Mabuza said the motive of the person who illegally accessed the website remains unknown, as are the motives of those who tried to generate a social media campaign against Ithuba based on the interdict.

“We regard this as yet another attempt to undermine our integrity and the robust steps we take, daily, to counter cyberattacks and to ensure the complete integrity of our systems and processes.”

Ithuba has noticed that traffic on its website has been unusually high in the past few months. This was followed by a flurry of comments and allegations on social media.

“We monitor our systems every day and we are able to see these activities. There was unusual traffic, and it was clear that there was an attempt to hack the system.”

On social media, Mabuza has even been accused of rigging the lotto draw to secure jackpots worth millions of rands for herself and her family. This, her accusers charged, was the reason the company stopped the live broadcast of the lotto draw.

“I can emphatically tell you that it is not true. Our rules do not allow Ithuba employees, the board, and myself to play the lotto, as a way of protecting the integrity of the lotto. These allegations are baseless. I am very confident in the auditing processes that are in place. We have an independent auditor and also our regulator NLC [National Lottery Commission] has a compliance process. Everything is open and transparent.”

She said the decision to stop the live TV broadcast, taken six years ago, was because of changes in technology worldwide.

“Everybody is moving into RNG [random number generator] and it couldn’t have happened at a better time because those that didn’t move to RNG couldn’t operate during Covid as it would have required a physical draw of numbers. We were very fortunate because we embraced technology earlier. We would have been more hamstrung during the Covid period.”

 RNG technology is also used in casinos. The lotto draw is streamed on video platform YouTube in the presence of Mazars auditors. Winning numbers are immediately streamed on TV and social media platforms. They are also published by major newspapers. Ithuba’s RNG platform is operated independently by an international company, she said.

Ithuba will apply for a renewal of its licence. If it succeeds it will be the first operator to run the lottery consecutively. The previous lottery operators were Uthingo and Gidani.

“The stakes are high and we won’t back down. We will raise our hands as we believe we are qualified and no matter what is thrown at us, we will keep focusing on what we do. These things are meant to distract us, and we believe we are best placed to continue providing this service,” she said.

According to the NLC, the deadline for submission of bids is February and evaluation and adjudication will commence immediately after that. The successful bidder is expected to be announced in September.

Ithuba employs 166 people and is setting up new lotto operations in Uganda, Tanzania and Botswana.

“We are the only company that has the technology to run this ... the back end, the central server, the IP,” said Mabuza.

Over the years, with the improvement in technology, punters have been able to buy lotto tickets online, also through their banking apps. Sales from online platforms have caught up with physical sales and are likely to surpass them, Mabuza said.

With load-shedding ramping up, which sometimes affects telecommunications networks, machines operate on two networks to keep the system running and Ithuba also provides inverters to small retailers.